<div dir="ltr">I don&#39;t recall, honestly.  Removable partitions are called out in the CCI mappings: <div><a href="http://scap-securityguide.rhcloud.com/RHEL6/output/table-rhel6-srgmap.html">http://scap-securityguide.rhcloud.com/RHEL6/output/table-rhel6-srgmap.html</a></div>
<div><br></div><div>and the draft settings for the STIG:</div><div><a href="http://scap-securityguide.rhcloud.com/RHEL6/output/table-stig-rhel6.html">http://scap-securityguide.rhcloud.com/RHEL6/output/table-stig-rhel6.html</a></div>
<div class="gmail_extra"><br><br><div class="gmail_quote">On Thu, Jul 3, 2014 at 12:16 PM, Shawn Wells <span dir="ltr">&lt;<a href="mailto:shawn@redhat.com" target="_blank">shawn@redhat.com</a>&gt;</span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">

  
    
  
  <div text="#000000" bgcolor="#FFFFFF"><div class="">
    <br>
    <div>On 7/3/14, 11:46 AM, Steve Grubb wrote:<br>
    </div>
    <blockquote type="cite">
      <div style="font-family:-moz-fixed;font-size:12px" lang="x-unicode">
        <pre>On Thursday, July 03, 2014 04:21:05 PM Stuart Green wrote:
</pre>
        <blockquote type="cite" style="color:#000000">
          <pre><span>&gt; </span>One of the hardening parameters we use to stop execution of programs on 
<span>&gt; </span>certain partitions is noexec in fstab, this is a general C.I.S 
<span>&gt; </span>requirement.  I believe the only requirement advising this in the 
<span>&gt; </span>context of this list is to do with Removable Media Partitions.
</pre>
        </blockquote>
        <pre>Generally you would want anywhere a program can be compiled because the 
directory is writable by anyone. For example, /tmp, /var/tmp, /dev/shm.</pre>
      </div>
    </blockquote>
    <br></div>
    Right. We&#39;ve content for removable partitions:<br>
<a href="https://github.com/OpenSCAP/scap-security-guide/blob/master/RHEL/6/input/system/permissions/partitions.xml#L54%23L74" target="_blank">https://github.com/OpenSCAP/scap-security-guide/blob/master/RHEL/6/input/system/permissions/partitions.xml#L54#L74</a><br>

    <br>
    /tmp:<br>
<a href="https://github.com/OpenSCAP/scap-security-guide/blob/master/RHEL/6/input/system/permissions/partitions.xml#L110%23L122" target="_blank">https://github.com/OpenSCAP/scap-security-guide/blob/master/RHEL/6/input/system/permissions/partitions.xml#L110#L122</a><br>

    <br>
    and /dev/shm:<br>
<a href="https://github.com/OpenSCAP/scap-security-guide/blob/master/RHEL/6/input/system/permissions/partitions.xml#L153%23L166" target="_blank">https://github.com/OpenSCAP/scap-security-guide/blob/master/RHEL/6/input/system/permissions/partitions.xml#L153#L166</a><br>

    <br>
    /var/tmp is bind mounted to /tmp, hence no callout for noexec:<br>
<a href="https://github.com/OpenSCAP/scap-security-guide/blob/master/RHEL/6/input/system/permissions/partitions.xml#L182%23L197" target="_blank">https://github.com/OpenSCAP/scap-security-guide/blob/master/RHEL/6/input/system/permissions/partitions.xml#L182#L197</a><br>

    <br>
    Interestingly, only /tmp is called out in the STIG (inherited from
    common)... and I don&#39;t remember why the others aren&#39;t. Especially
    removable partitions.<br>
    <br>
    Jeff? Dave? FSO?<div class=""><br>
    <br>
    <br>
    <blockquote type="cite">
      <div style="font-family:-moz-fixed;font-size:12px" lang="x-unicode">
        <blockquote type="cite" style="color:#000000">
          <pre><span>&gt; </span>I&#39;ve noted myself that you can still execute bash scripts in these 
<span>&gt; </span>partitions by utilising /bin/sh  (bash),  in our environment /bin/sh is 
<span>&gt; </span>set to -rwxr-xr-x which I belive is an OOB setting, should this be 
<span>&gt; </span>refined to something more strict?
</pre>
        </blockquote>
        <pre>Actually, you need to think about this a bit. The script is not executing, its 
being interpreted. The interpreter is executed. There is no way short of 
patching all interpreters to look at the partition flags to decide if it should 
interpret the script based on its path. Even so, you can have commands passed 
over stdin with cat and hide the location it comes from.

So, I understand the concern but the reality is that its virtually impossible 
to lock down.
</pre>
      </div>
    </blockquote>
    <br>
  </div></div>

</blockquote></div><br><br clear="all"><div><br></div>
</div></div>