On Thursday, August 22, 2013 03:31:50 PM Steve Grubb wrote:
On Thursday, August 22, 2013 03:09:33 PM Maura Dailey wrote:
I might need to backtrack on this thread and see what's wrong. But partition_test should have all mount options.
I tried the following unsuccessfully while troubleshooting how to detect a bind mount of /tmp on /var/tmp (another check):
First, I ran 'mount --bind /var/tmp /tmp
Then I tried this chunk of code in place of the
mount_option_var_tmp_bind check: <linux:partition_test id ="test_mount_option_var_tmp_bind"
version="1" comment="Detect bind mount" check="all">
<linux:object object_ref="object_mount_option_var_tmp_bind" /></linux:partition_test>
<linux:partition_object id="object_mount_option_var_tmp_bind"
version="1">
<linux:mount_point operation="pattern match">^.*$</linux:mount_point></linux:partition_object>
I wasn't even trying to search for mount options yet, just get a complete list of all mounts. The resulting OVAL that testcheck.py generated did NOT show any bind mount options for any mount point detected. /var/tmp, which I was trying to detect, was an exact duplicate of /tmp's own mount section (and an exact duplicate out the output of /proc/mounts, which is where I developed my suspicions about the source of its data). I'm using oscap 0.9.3.
I wrote a test program to see what's happening. It would appear that the "bind" option is being dropped inside the kernel and its not reflected in /proc/mounts. However, the information is available in statvfs. So, if we need the bind flag, and I suspect we do, we can add it to the mount options returned by getmntent_r(3) in openscap's partition probe.
Do we need the bind mount flag?
In talking with Al Viro, he said that bind, move, and remount options are not displayed in /proc/mounts because its a "method" for creating the filesystem and not a "property" of the file system. The default method is "add". Of those, remount seems like something that is important for security assessment as well. It hides the real and permanent mount flags.
So, I think we can dig those out of the OS and append those to what we have in /proc/mounts. This would better reflect what is found by parsing /etc/fstab. But one things for sure, I don't think its specified where an OVAL probe looks to get the mount flags. So, there could be some variance in implementation. I'd probably need to give a hint on the OVAL devel list to make sure people know getmntent(3) is incomplete regarding mount methods.
-Steve