Re: [PATCH] Check will return list of all partitions without nodev instead of a complete list of all partitions and the return value of true/false will accurately reflect passing or failing

[Shawn Wells]

On 8/21/13 4:36 PM, Maura Dailey wrote:
> One quick thing I forgot to add: this will give you false positives 
> for bind mounted partitions, as I found out when I finally tracked a 
> phantom non-existent /home partition (underneath an NFS mount in the 
> same location) back to the sandbox service. /proc/mounts, which is 
> where linux:partition_test apparently reads from, doesn't know or care 
> which mounts are bind mounted. Additionally, the sandbox service runs 
> mount directly, so there's no evidence of this particular type of bind 
> mount in /etc/fstab either.

Definitely don't want deployments getting dinged about this, have to 
create a waiver, describe to their ISSO/ISSM, etc. Should the XCCDF be 
updated to reflect this known false positive?