<div dir="ltr">Thanks for these, please push!<br></div><div class="gmail_extra"><br><br><div class="gmail_quote">On Wed, Sep 18, 2013 at 11:53 AM, Maura Dailey <span dir="ltr"><<a href="mailto:maura@eclipse.ncsc.mil" target="_blank">maura@eclipse.ncsc.mil</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">Pushing out some checks I tested a little while back. I've verified that no other changes were made on the mailing list.<br>
<br>
- Maura Dailey<br>
<br>
---<br>
RHEL6/input/checks/mount_option_dev_shm_nodev.xml | 7 +++++--<br>
RHEL6/input/checks/mount_option_dev_shm_noexec.xml | 14 +++++++++-----<br>
RHEL6/input/checks/mount_option_dev_shm_nosuid.xml | 13 ++++++++-----<br>
3 files changed, 22 insertions(+), 12 deletions(-)<br>
<br>
diff --git a/RHEL6/input/checks/mount_option_dev_shm_nodev.xml b/RHEL6/input/checks/mount_option_dev_shm_nodev.xml<br>
index 09b69b6..f00b9e9 100644<br>
--- a/RHEL6/input/checks/mount_option_dev_shm_nodev.xml<br>
+++ b/RHEL6/input/checks/mount_option_dev_shm_nodev.xml<br>
@@ -8,12 +8,14 @@<br>
<description>Legitimate character and block devices should not exist<br>
within temporary directories like /dev/shm. The nodev mount option should<br>
be specified for /dev/shm.</description><br>
+ <reference source="MED" ref_id="20130820" ref_url="test_attestation" /><br>
</metadata><br>
<criteria><br>
<criterion comment="nodev on /dev/shm" test_ref="test_nodev_dev_shm" /><br>
</criteria><br>
</definition><br>
- <linux:partition_test check="all" check_existence="all_exist" id="test_nodev_dev_shm" version="1" comment="nodev on /dev/shm"><br>
+ <linux:partition_test check="all" check_existence="all_exist"<br>
+ id="test_nodev_dev_shm" version="1" comment="nodev on /dev/shm"><br>
<linux:object object_ref="object_dev_shm_partition_nodev" /><br>
<linux:state state_ref="state_dev_shm_nodev" /><br>
</linux:partition_test><br>
@@ -21,6 +23,7 @@<br>
<linux:mount_point>/dev/shm</linux:mount_point><br>
</linux:partition_object><br>
<linux:partition_state id="state_dev_shm_nodev" version="1"><br>
- <linux:mount_options datatype="string" entity_check="at least one" operation="equals">nodev</linux:mount_options><br>
+ <linux:mount_options datatype="string" entity_check="at least one"<br>
+ operation="equals">nodev</linux:mount_options><br>
</linux:partition_state><br>
</def-group><br>
diff --git a/RHEL6/input/checks/mount_option_dev_shm_noexec.xml b/RHEL6/input/checks/mount_option_dev_shm_noexec.xml<br>
index 25ac4fb..825f761 100644<br>
--- a/RHEL6/input/checks/mount_option_dev_shm_noexec.xml<br>
+++ b/RHEL6/input/checks/mount_option_dev_shm_noexec.xml<br>
@@ -5,15 +5,18 @@<br>
<affected family="unix"><br>
<platform>Red Hat Enterprise Linux 6</platform><br>
</affected><br>
- <description>It can be dangerous to allow the execution of binaries<br>
- from world-writable temporary storage directories such as /dev/shm.<br>
- The noexec mount option prevents binaries from being executed out of /dev/shm.</description><br>
+ <description>It can be dangerous to allow the execution of binaries from<br>
+ world-writable temporary storage directories such as /dev/shm. The noexec<br>
+ mount option prevents binaries from being executed out of<br>
+ /dev/shm.</description><br>
+ <reference source="MED" ref_id="20130821" ref_url="test_attestation" /><br>
</metadata><br>
<criteria><br>
<criterion comment="noexec on /dev/shm" test_ref="test_noexec_dev_shm" /><br>
</criteria><br>
</definition><br>
- <linux:partition_test check="all" check_existence="all_exist" id="test_noexec_dev_shm" version="1" comment="noexec on /dev/shm"><br>
+ <linux:partition_test check="all" check_existence="all_exist"<br>
+ id="test_noexec_dev_shm" version="1" comment="noexec on /dev/shm"><br>
<linux:object object_ref="object_dev_shm_partition_noexec" /><br>
<linux:state state_ref="state_dev_shm_noexec" /><br>
</linux:partition_test><br>
@@ -21,6 +24,7 @@<br>
<linux:mount_point>/dev/shm</linux:mount_point><br>
</linux:partition_object><br>
<linux:partition_state id="state_dev_shm_noexec" version="1"><br>
- <linux:mount_options datatype="string" entity_check="at least one" operation="equals">noexec</linux:mount_options><br>
+ <linux:mount_options datatype="string" entity_check="at least one"<br>
+ operation="equals">noexec</linux:mount_options><br>
</linux:partition_state><br>
</def-group><br>
diff --git a/RHEL6/input/checks/mount_option_dev_shm_nosuid.xml b/RHEL6/input/checks/mount_option_dev_shm_nosuid.xml<br>
index e7c517d..2bc1463 100644<br>
--- a/RHEL6/input/checks/mount_option_dev_shm_nosuid.xml<br>
+++ b/RHEL6/input/checks/mount_option_dev_shm_nosuid.xml<br>
@@ -5,15 +5,17 @@<br>
<affected family="unix"><br>
<platform>Red Hat Enterprise Linux 6</platform><br>
</affected><br>
- <description>The nosuid mount option should be set for temporary<br>
- storage partitions such as /dev/shm. The suid/sgid permissions<br>
- should not be required in these world-writable directories.</description><br>
+ <description>The nosuid mount option should be set for temporary storage<br>
+ partitions such as /dev/shm. The suid/sgid permissions should not be<br>
+ required in these world-writable directories.</description><br>
+ <reference source="MED" ref_id="20130821" ref_url="test_attestation" /><br>
</metadata><br>
<criteria><br>
<criterion comment="nosuid on /dev/shm" test_ref="test_nosuid_dev_shm" /><br>
</criteria><br>
</definition><br>
- <linux:partition_test check="all" check_existence="all_exist" id="test_nosuid_dev_shm" version="1" comment="nosuid on /dev/shm"><br>
+ <linux:partition_test check="all" check_existence="all_exist"<br>
+ id="test_nosuid_dev_shm" version="1" comment="nosuid on /dev/shm"><br>
<linux:object object_ref="object_dev_shm_partition_nosuid" /><br>
<linux:state state_ref="state_dev_shm_nosuid" /><br>
</linux:partition_test><br>
@@ -21,6 +23,7 @@<br>
<linux:mount_point>/dev/shm</linux:mount_point><br>
</linux:partition_object><br>
<linux:partition_state id="state_dev_shm_nosuid" version="1"><br>
- <linux:mount_options datatype="string" entity_check="at least one" operation="equals">nosuid</linux:mount_options><br>
+ <linux:mount_options datatype="string" entity_check="at least one"<br>
+ operation="equals">nosuid</linux:mount_options><br>
</linux:partition_state><br>
</def-group><br>
<span class="HOEnZb"><font color="#888888">--<br>
1.7.1<br>
<br>
_______________________________________________<br>
scap-security-guide mailing list<br>
<a href="mailto:scap-security-guide@lists.fedorahosted.org">scap-security-guide@lists.fedorahosted.org</a><br>
<a href="https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide" target="_blank">https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide</a><br>
</font></span></blockquote></div><br></div>