One quick thing I forgot to add: this will give you false positives for bind mounted partitions, as I found out when I finally tracked a phantom non-existent /home partition (underneath an NFS mount in the same location) back to the sandbox service. /proc/mounts, which is where linux:partition_test apparently reads from, doesn't know or care which mounts are bind mounted. Additionally, the sandbox service runs mount directly, so there's no evidence of this particular type of bind mount in /etc/fstab either.
- Maura Dailey
On 08/21/2013 04:24 PM, Maura Dailey wrote:
Signed-off-by: Maura Dailey maura@eclipse.ncsc.mil
...mount_option_nodev_nonroot_local_partitions.xml | 28 ++++++++++--------- 1 files changed, 15 insertions(+), 13 deletions(-)
diff --git a/RHEL6/input/checks/mount_option_nodev_nonroot_local_partitions.xml b/RHEL6/input/checks/mount_option_nodev_nonroot_local_partitions.xml index a5e6334..e0abd50 100644 --- a/RHEL6/input/checks/mount_option_nodev_nonroot_local_partitions.xml +++ b/RHEL6/input/checks/mount_option_nodev_nonroot_local_partitions.xml @@ -1,36 +1,38 @@
<def-group> - <definition class="compliance" id="mount_option_nodev_nonroot_local_partitions" version="1"> + <definition class="compliance" + id="mount_option_nodev_nonroot_local_partitions" version="1"> <metadata> <title>Add nodev Option to Non-Root Local Partitions</title> <affected family="unix"> <platform>Red Hat Enterprise Linux 6</platform> </affected> - <description>The nodev mount option prevents files from being - interpreted as character or block devices. Legitimate character and block - devices should exist in the /dev directory on the root partition or - within chroot jails built for system services. All other locations should not - allow character and block devices.</description> + <description>The nodev mount option prevents files from being interpreted + as character or block devices. Legitimate character and block devices + should exist in the /dev directory on the root partition or within chroot + jails built for system services. All other locations should not allow + character and block devices.</description> + <reference source="MED" ref_id="20130821" ref_url="test_attestation" /> </metadata> <criteria> - <criterion comment="nodev on local filesystems" test_ref="test_nodev_nonroot_local_partitions" /> + <criterion comment="nodev on local filesystems" + test_ref="test_nodev_nonroot_local_partitions" negate="true" /> </criteria> </definition> - - <linux:partition_test check="all" check_existence="all_exist" id="test_nodev_nonroot_local_partitions" version="1" comment="nodev on local filesystems"> + <linux:partition_test check="all" check_existence="all_exist" + id="test_nodev_nonroot_local_partitions" version="1" + comment="nodev on local filesystems"> <linux:object object_ref="object_non_root_partitions" /> <linux:state state_ref="state_local_nodev" /> </linux:partition_test> - <linux:partition_object id="object_non_root_partitions" version="1"> <!-- look at all partitions except root --> <linux:mount_point operation="pattern match">^/\w.*$</linux:mount_point> <filter action="include">state_local_nodev</filter> </linux:partition_object> - <linux:partition_state id="state_local_nodev" version="1"> <!-- this check defines a local partition as one which has a device node in /dev --> <linux:device operation="pattern match">^/dev/.*$</linux:device> - <linux:mount_options datatype="string" entity_check="at least one" operation="equals">nodev</linux:mount_options> + <linux:mount_options datatype="string" entity_check="all" + operation="not equal">nodev</linux:mount_options> </linux:partition_state> - </def-group>