Merge pull request #10794 from Mab879/add_mount_platforms

Add mount platforms
ComplianceAsCode · Jul 4, 2023 · f81a5aa · f81a5aa
2 parents 045d2b1 + 1e3ed5a
commit f81a5aa
Show file tree

Hide file tree

Showing 15 changed files with 31 additions and 16 deletions.
diff --git a/linux_os/guide/system/permissions/partitions/mount_option_home_grpquota/rule.yml b/linux_os/guide/system/permissions/partitions/mount_option_home_grpquota/rule.yml
@@ -25,8 +25,6 @@ references:
  cis@rhel8: 1.1.7.5
  nist: CM-6(b)
 
-platform: machine
-
 {{{ complete_ocil_entry_mount_option("/home", "grpquota") }}}
 
 fixtext: '{{{ fixtext_mount_option("/home", "grpquota") }}}'
@@ -53,11 +51,13 @@ warnings:
 {{% endif %}}
 
 {{% if "ol" in product %}}
+platform: machine
 template:
  name: mount_option_home
  vars:
  mountoption: grpquota
 {{% else %}}
+platform: machine and mount[home]
 template:
  name: mount_option
  vars:

diff --git a/linux_os/guide/system/permissions/partitions/mount_option_home_nodev/rule.yml b/linux_os/guide/system/permissions/partitions/mount_option_home_nodev/rule.yml
@@ -42,7 +42,7 @@ references:
  cis@ubuntu2204: 1.1.7.2
  srg: SRG-OS-000368-GPOS-00154
 
-platform: machine
+platform: machine and mount[home]
 
 template:
  name: mount_option

diff --git a/linux_os/guide/system/permissions/partitions/mount_option_home_nosuid/rule.yml b/linux_os/guide/system/permissions/partitions/mount_option_home_nosuid/rule.yml
@@ -46,7 +46,6 @@ references:
  stigid@sle12: SLES-12-010790
  stigid@sle15: SLES-15-040140
 
-platform: machine
 
 {{{ complete_ocil_entry_mount_option("/home", "nosuid") }}}
 
@@ -56,12 +55,14 @@ fixtext: |-
 srg_requirement: '{{{ srg_requirement_mount_option("/home", "nosuid") }}}'
 
 {{% if "ol" not in product %}}
+platform: machine and mount[home]
 template:
  name: mount_option
  vars:
  mountpoint: /home
  mountoption: nosuid
 {{% else %}}
+platform: machine
 warnings:
  - functionality: |-
  OVAL looks for partitions whose mount point is a substring of any interactive user's home

diff --git a/linux_os/guide/system/permissions/partitions/mount_option_home_usrquota/rule.yml b/linux_os/guide/system/permissions/partitions/mount_option_home_usrquota/rule.yml
@@ -25,7 +25,7 @@ references:
  cis@rhel8: 1.1.7.4
  nist: CM-6(b)
 
-platform: machine
+
 
 {{{ complete_ocil_entry_mount_option("/home", "usrquota") }}}
 
@@ -53,11 +53,13 @@ warnings:
 {{% endif %}}
 
 {{% if "ol" in product %}}
+platform: machine
 template:
  name: mount_option_home
  vars:
  mountoption: usrquota
 {{% else %}}
+platform: machine and mount[home]
 template:
  name: mount_option
  vars:

diff --git a/linux_os/guide/system/permissions/partitions/mount_option_opt_nosuid/rule.yml b/linux_os/guide/system/permissions/partitions/mount_option_opt_nosuid/rule.yml
@@ -29,7 +29,7 @@ identifiers:
 references:
  anssi: BP28(R12)
 
-platform: machine
+platform: machine and mount[opt]
 
 template:
  name: mount_option

diff --git a/linux_os/guide/system/permissions/partitions/mount_option_srv_nosuid/rule.yml b/linux_os/guide/system/permissions/partitions/mount_option_srv_nosuid/rule.yml
@@ -29,7 +29,7 @@ identifiers:
 references:
  anssi: BP28(R12)
 
-platform: machine
+platform: machine and mount[srv]
 
 template:
  name: mount_option

diff --git a/linux_os/guide/system/permissions/partitions/mount_option_var_log_audit_nodev/rule.yml b/linux_os/guide/system/permissions/partitions/mount_option_var_log_audit_nodev/rule.yml
@@ -37,7 +37,7 @@ references:
  stigid@ol8: OL08-00-040129
  stigid@rhel8: RHEL-08-040129
 
-platform: machine
+platform: machine and mount[var-log-audit]
 
 template:
  name: mount_option

diff --git a/linux_os/guide/system/permissions/partitions/mount_option_var_log_audit_noexec/rule.yml b/linux_os/guide/system/permissions/partitions/mount_option_var_log_audit_noexec/rule.yml
@@ -35,7 +35,7 @@ references:
  stigid@ol8: OL08-00-040131
  stigid@rhel8: RHEL-08-040131
 
-platform: machine
+platform: machine and mount[var-log-audit]
 
 template:
  name: mount_option

diff --git a/linux_os/guide/system/permissions/partitions/mount_option_var_log_audit_nosuid/rule.yml b/linux_os/guide/system/permissions/partitions/mount_option_var_log_audit_nosuid/rule.yml
@@ -36,7 +36,7 @@ references:
  stigid@ol8: OL08-00-040130
  stigid@rhel8: RHEL-08-040130
 
-platform: machine
+platform: machine and mount[var-log-audit]
 
 template:
  name: mount_option

diff --git a/linux_os/guide/system/permissions/partitions/mount_option_var_log_nodev/rule.yml b/linux_os/guide/system/permissions/partitions/mount_option_var_log_nodev/rule.yml
@@ -37,7 +37,7 @@ references:
  stigid@ol8: OL08-00-040126
  stigid@rhel8: RHEL-08-040126
 
-platform: machine
+platform: machine and mount[var-log]
 
 template:
  name: mount_option

diff --git a/linux_os/guide/system/permissions/partitions/mount_option_var_log_noexec/rule.yml b/linux_os/guide/system/permissions/partitions/mount_option_var_log_noexec/rule.yml
@@ -38,7 +38,7 @@ references:
  stigid@ol8: OL08-00-040128
  stigid@rhel8: RHEL-08-040128
 
-platform: machine
+platform: machine and mount[var-log]
 
 template:
  name: mount_option

diff --git a/linux_os/guide/system/permissions/partitions/mount_option_var_log_nosuid/rule.yml b/linux_os/guide/system/permissions/partitions/mount_option_var_log_nosuid/rule.yml
@@ -39,7 +39,7 @@ references:
  stigid@ol8: OL08-00-040127
  stigid@rhel8: RHEL-08-040127
 
-platform: machine
+platform: machine and mount[var-log]
 
 template:
  name: mount_option

diff --git a/linux_os/guide/system/permissions/partitions/mount_option_var_nodev/rule.yml b/linux_os/guide/system/permissions/partitions/mount_option_var_nodev/rule.yml
@@ -34,7 +34,7 @@ references:
  nist-csf: PR.IP-1,PR.PT-2,PR.PT-3
  srg: SRG-OS-000368-GPOS-00154
 
-platform: machine
+platform: machine and mount[var]
 
 template:
  name: mount_option

diff --git a/linux_os/guide/system/permissions/partitions/mount_option_var_noexec/rule.yml b/linux_os/guide/system/permissions/partitions/mount_option_var_noexec/rule.yml
@@ -6,7 +6,7 @@ title: 'Add noexec Option to /var'
 
 description: |-
  The <tt>noexec</tt> mount option can be used to prevent binaries from being
- executed out of <tt>/var</tt>. 
+ executed out of <tt>/var</tt>.
  {{{ describe_mount(option="noexec", part="/var") }}}
 
 rationale: |-
@@ -29,7 +29,7 @@ references:
  cis@alinux3: 1.1.3.2
  cis@rhel8: 1.1.3.3
 
-platform: machine
+platform: machine and mount[var]
 
 template:
  name: mount_option

diff --git a/shared/applicability/mount.yml b/shared/applicability/mount.yml
@@ -6,7 +6,19 @@ ansible_conditional: {{{ ansible_mount_conditional("{mountpoint}") }}}
 template:
  name: platform_mount
 args:
+ home:
+ mountpoint: /home
+ opt:
+ mountpoint: /opt
+ srv:
+ mountpoint: /srv
  tmp:
  mountpoint: /tmp
+ var:
+ mountpoint: /var
+ var-log:
+ mountpoint: /var/log
+ var-log-audit:
+ mountpoint: /var/log/audit
  var-tmp:
  mountpoint: /var/tmp