On Thursday, August 22, 2013 03:09:33 PM Maura Dailey wrote:
I might need to backtrack on this thread and see what's wrong. But partition_test should have all mount options.
I tried the following unsuccessfully while troubleshooting how to detect a bind mount of /tmp on /var/tmp (another check):
First, I ran 'mount --bind /var/tmp /tmp
Then I tried this chunk of code in place of the mount_option_var_tmp_bind check: <linux:partition_test id ="test_mount_option_var_tmp_bind" version="1" comment="Detect bind mount" check="all"> <linux:object object_ref="object_mount_option_var_tmp_bind" /> </linux:partition_test>
<linux:partition_object id="object_mount_option_var_tmp_bind" version="1"> <linux:mount_point operation="pattern match">^.*$</linux:mount_point> </linux:partition_object>
I wasn't even trying to search for mount options yet, just get a complete list of all mounts. The resulting OVAL that testcheck.py generated did NOT show any bind mount options for any mount point detected. /var/tmp, which I was trying to detect, was an exact duplicate of /tmp's own mount section (and an exact duplicate out the output of /proc/mounts, which is where I developed my suspicions about the source of its data). I'm using oscap 0.9.3.
I wrote a test program to see what's happening. It would appear that the "bind" option is being dropped inside the kernel and its not reflected in /proc/mounts. However, the information is available in statvfs. So, if we need the bind flag, and I suspect we do, we can add it to the mount options returned by getmntent_r(3) in openscap's partition probe.
Do we need the bind mount flag?
-Steve