<div dir="ltr">What&#39;s the GENID on this? I didn&#39;t find it in the Jun STIG.<br><br>Thanks!<br><br>Leam<br></div><div class="gmail_extra"><br><br><div class="gmail_quote">On Tue, Sep 10, 2013 at 12:49 PM, Maura Dailey <span dir="ltr">&lt;<a href="mailto:maura@eclipse.ncsc.mil" target="_blank">maura@eclipse.ncsc.mil</a>&gt;</span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><br>
Signed-off-by: Maura Dailey &lt;<a href="mailto:maura@eclipse.ncsc.mil">maura@eclipse.ncsc.mil</a>&gt;<br>
---<br>
 RHEL6/input/checks/mount_option_var_tmp_bind.xml |   44 +++++++++++++++-------<br>
 1 files changed, 30 insertions(+), 14 deletions(-)<br>
<br>
diff --git a/RHEL6/input/checks/mount_option_var_tmp_bind.xml b/RHEL6/input/checks/mount_option_var_tmp_bind.xml<br>
index 4d549c2..02630a7 100644<br>
--- a/RHEL6/input/checks/mount_option_var_tmp_bind.xml<br>
+++ b/RHEL6/input/checks/mount_option_var_tmp_bind.xml<br>
@@ -5,24 +5,40 @@<br>
       &lt;affected family=&quot;unix&quot;&gt;<br>
         &lt;platform&gt;Red Hat Enterprise Linux 6&lt;/platform&gt;<br>
       &lt;/affected&gt;<br>
-      &lt;description&gt;The /var/tmp directory should be bind mounted to /tmp<br>
-      in order to consolidate temporary storage into one location protected by the same<br>
-      techniques as /tmp.&lt;/description&gt;<br>
+      &lt;description&gt;The /var/tmp directory should be bind mounted to /tmp in<br>
+      order to consolidate temporary storage into one location protected by the<br>
+      same techniques as /tmp.&lt;/description&gt;<br>
+      &lt;reference source=&quot;MED&quot; ref_id=&quot;20130821&quot; ref_url=&quot;test_attestation&quot; /&gt;<br>
     &lt;/metadata&gt;<br>
-    &lt;criteria&gt;<br>
-      &lt;criterion comment=&quot;Unknown test stub&quot; test_ref=&quot;test_bind_mount_var_tmp&quot; /&gt;<br>
+    &lt;criteria operator=&quot;AND&quot;&gt;<br>
+      &lt;criterion comment=&quot;Ensure /var/tmp is mounted&quot;<br>
+      test_ref=&quot;test_mount_option_var_tmp&quot; /&gt;<br>
+      &lt;criterion comment=&quot;Ensure /tmp is bind mounted&quot;<br>
+      test_ref=&quot;test_mount_option_var_tmp_bind&quot; /&gt;<br>
     &lt;/criteria&gt;<br>
   &lt;/definition&gt;<br>
+  &lt;linux:partition_test id=&quot;test_mount_option_var_tmp&quot; version=&quot;1&quot;<br>
+  comment=&quot;Ensure /var/tmp is mounted&quot; check=&quot;all&quot;&gt;<br>
+    &lt;linux:object object_ref=&quot;object_mount_option_var_tmp&quot; /&gt;<br>
+  &lt;/linux:partition_test&gt;<br>
+  &lt;linux:partition_object id=&quot;object_mount_option_var_tmp&quot; version=&quot;1&quot;&gt;<br>
+    &lt;linux:mount_point operation=&quot;pattern match&quot;&gt;/var/tmp&lt;/linux:mount_point&gt;<br>
+  &lt;/linux:partition_object&gt;<br>
<br>
-  &lt;ind:textfilecontent54_test check=&quot;all&quot; check_existence=&quot;at_least_one_exists&quot; comment=&quot;bind mount /var/tmp to /tmp&quot; id=&quot;test_bind_mount_var_tmp&quot; version=&quot;1&quot;&gt;<br>

-    &lt;ind:object object_ref=&quot;object_bind_mount_var_tmp&quot; /&gt;<br>
-  &lt;/ind:textfilecontent54_test&gt;<br>
+  &lt;!-- The linux:partition_test reads from /proc/mounts, which does not record<br>
+       the bind mount option. As a result, the less elegant textfilecontent54_test<br>
+       is required here. --&gt;<br>
<br>
-  &lt;ind:textfilecontent54_object comment=&quot;look for the partition mount point in /etc/fstab&quot; id=&quot;object_bind_mount_var_tmp&quot; version=&quot;1&quot;&gt;<br>
-    &lt;ind:path&gt;/etc&lt;/ind:path&gt;<br>
-    &lt;ind:filename&gt;fstab&lt;/ind:filename&gt;<br>
-    &lt;ind:pattern operation=&quot;pattern match&quot;&gt;^\s*/tmp\s+/var/tmp\s.*bind.*$&lt;/ind:pattern&gt;<br>
-    &lt;ind:instance datatype=&quot;int&quot; operation=&quot;greater than or equal&quot;&gt;1&lt;/ind:instance&gt;<br>
+  &lt;ind:textfilecontent54_test check=&quot;all&quot; check_existence=&quot;at_least_one_exists&quot;<br>
+  comment=&quot;Ensure bind mount option is on /var/tmp&quot;<br>
+  id=&quot;test_mount_option_var_tmp_bind&quot; version=&quot;1&quot;&gt;<br>
+    &lt;ind:object object_ref=&quot;object_mount_option_var_tmp_bind&quot; /&gt;<br>
+  &lt;/ind:textfilecontent54_test&gt;<br>
+  &lt;ind:textfilecontent54_object comment=&quot;look for the partition mount point in /etc/mtab&quot;<br>
+  id=&quot;object_mount_option_var_tmp_bind&quot; version=&quot;1&quot;&gt;<br>
+    &lt;ind:filepath&gt;/etc/mtab&lt;/ind:filepath&gt;<br>
+    &lt;ind:pattern operation=&quot;pattern match&quot;&gt;^[\s]*/tmp[\s]+/var/tmp[\s]+.*bind.*$&lt;/ind:pattern&gt;<br>
+    &lt;ind:instance datatype=&quot;int&quot; operation=&quot;greater than or equal&quot;&gt;<br>
+    1&lt;/ind:instance&gt;<br>
   &lt;/ind:textfilecontent54_object&gt;<br>
-<br>
 &lt;/def-group&gt;<br>
<span class="HOEnZb"><font color="#888888">--<br>
1.7.1<br>
<br>
_______________________________________________<br>
scap-security-guide mailing list<br>
<a href="mailto:scap-security-guide@lists.fedorahosted.org">scap-security-guide@lists.fedorahosted.org</a><br>
<a href="https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide" target="_blank">https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide</a><br>
</font></span></blockquote></div><br><br clear="all"><br>-- <br><div><a href="http://leamhall.blogspot.com/" target="_blank">Mind on a Mission</a></div>
</div>