Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Add mount platforms #10794

Merged
merged 15 commits into from
Jul 4, 2023
Merged

Add mount platforms #10794

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
15 commits
Select commit Hold shift + click to select a range
61e040a
Add new missing mount platforms
Mab879 Jul 3, 2023
018d040
Add mount platform to mount_option_var_noexec
Mab879 Jul 3, 2023
dcd69ae
Add mount platform to mount_option_var_nodev
Mab879 Jul 3, 2023
42d8b1d
Add mount platform to mount_option_var_log_nosuid
Mab879 Jul 3, 2023
f450303
Add mount platform to mount_option_var_log_noexec
Mab879 Jul 3, 2023
0d40abc
Add mount platform to mount_option_var_log_nodev
Mab879 Jul 3, 2023
498c5ae
Add mount platform to mount_option_var_log_audit_nosuid
Mab879 Jul 3, 2023
95dce53
Add mount platform to mount_option_var_log_audit_noexec
Mab879 Jul 3, 2023
523a0b0
Add mount platform to mount_option_var_log_audit_nodev
Mab879 Jul 3, 2023
7475c97
Add mount platform to mount_option_srv_nosuid
Mab879 Jul 3, 2023
2f588d3
Add mount platform to mount_option_opt_nosuid
Mab879 Jul 3, 2023
8beac58
Add mount platform to mount_option_home_usrquota
Mab879 Jul 3, 2023
0931a10
Add mount platform to mount_option_home_nosuid
Mab879 Jul 3, 2023
9efe859
Add mount platform to mount_option_home_nodev
Mab879 Jul 3, 2023
1e3ed5a
Add mount platform to mount_option_home_grpquota
Mab879 Jul 3, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 2 additions & 2 deletions linux_os/guide/system/permissions/partitions/mount_option_home_grpquota/rule.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -25,8 +25,6 @@ references:
cis@rhel8: 1.1.7.5
nist: CM-6(b)

platform: machine

{{{ complete_ocil_entry_mount_option("/home", "grpquota") }}}

fixtext: '{{{ fixtext_mount_option("/home", "grpquota") }}}'
Expand All @@ -53,11 +51,13 @@ warnings:
{{% endif %}}

{{% if "ol" in product %}}
platform: machine
template:
name: mount_option_home
vars:
mountoption: grpquota
{{% else %}}
platform: machine and mount[home]
template:
name: mount_option
vars:
Expand Down
2 changes: 1 addition & 1 deletion linux_os/guide/system/permissions/partitions/mount_option_home_nodev/rule.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -42,7 +42,7 @@ references:
cis@ubuntu2204: 1.1.7.2
srg: SRG-OS-000368-GPOS-00154

platform: machine
platform: machine and mount[home]

template:
name: mount_option
Expand Down
3 changes: 2 additions & 1 deletion linux_os/guide/system/permissions/partitions/mount_option_home_nosuid/rule.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -46,7 +46,6 @@ references:
stigid@sle12: SLES-12-010790
stigid@sle15: SLES-15-040140

platform: machine

{{{ complete_ocil_entry_mount_option("/home", "nosuid") }}}

Expand All @@ -56,12 +55,14 @@ fixtext: |-
srg_requirement: '{{{ srg_requirement_mount_option("/home", "nosuid") }}}'

{{% if "ol" not in product %}}
platform: machine and mount[home]
template:
name: mount_option
vars:
mountpoint: /home
mountoption: nosuid
{{% else %}}
platform: machine
warnings:
- functionality: |-
OVAL looks for partitions whose mount point is a substring of any interactive user's home
Expand Down
4 changes: 3 additions & 1 deletion linux_os/guide/system/permissions/partitions/mount_option_home_usrquota/rule.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -25,7 +25,7 @@ references:
cis@rhel8: 1.1.7.4
nist: CM-6(b)

platform: machine


{{{ complete_ocil_entry_mount_option("/home", "usrquota") }}}

Expand Down Expand Up @@ -53,11 +53,13 @@ warnings:
{{% endif %}}

{{% if "ol" in product %}}
platform: machine
template:
name: mount_option_home
vars:
mountoption: usrquota
{{% else %}}
platform: machine and mount[home]
template:
name: mount_option
vars:
Expand Down
2 changes: 1 addition & 1 deletion linux_os/guide/system/permissions/partitions/mount_option_opt_nosuid/rule.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -29,7 +29,7 @@ identifiers:
references:
anssi: BP28(R12)

platform: machine
platform: machine and mount[opt]

template:
name: mount_option
Expand Down
2 changes: 1 addition & 1 deletion linux_os/guide/system/permissions/partitions/mount_option_srv_nosuid/rule.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -29,7 +29,7 @@ identifiers:
references:
anssi: BP28(R12)

platform: machine
platform: machine and mount[srv]

template:
name: mount_option
Expand Down
2 changes: 1 addition & 1 deletion linux_os/guide/system/permissions/partitions/mount_option_var_log_audit_nodev/rule.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -37,7 +37,7 @@ references:
stigid@ol8: OL08-00-040129
stigid@rhel8: RHEL-08-040129

platform: machine
platform: machine and mount[var-log-audit]

template:
name: mount_option
Expand Down
2 changes: 1 addition & 1 deletion linux_os/guide/system/permissions/partitions/mount_option_var_log_audit_noexec/rule.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -35,7 +35,7 @@ references:
stigid@ol8: OL08-00-040131
stigid@rhel8: RHEL-08-040131

platform: machine
platform: machine and mount[var-log-audit]

template:
name: mount_option
Expand Down
2 changes: 1 addition & 1 deletion linux_os/guide/system/permissions/partitions/mount_option_var_log_audit_nosuid/rule.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -36,7 +36,7 @@ references:
stigid@ol8: OL08-00-040130
stigid@rhel8: RHEL-08-040130

platform: machine
platform: machine and mount[var-log-audit]

template:
name: mount_option
Expand Down
2 changes: 1 addition & 1 deletion linux_os/guide/system/permissions/partitions/mount_option_var_log_nodev/rule.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -37,7 +37,7 @@ references:
stigid@ol8: OL08-00-040126
stigid@rhel8: RHEL-08-040126

platform: machine
platform: machine and mount[var-log]

template:
name: mount_option
Expand Down
2 changes: 1 addition & 1 deletion linux_os/guide/system/permissions/partitions/mount_option_var_log_noexec/rule.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -38,7 +38,7 @@ references:
stigid@ol8: OL08-00-040128
stigid@rhel8: RHEL-08-040128

platform: machine
platform: machine and mount[var-log]

template:
name: mount_option
Expand Down
2 changes: 1 addition & 1 deletion linux_os/guide/system/permissions/partitions/mount_option_var_log_nosuid/rule.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -39,7 +39,7 @@ references:
stigid@ol8: OL08-00-040127
stigid@rhel8: RHEL-08-040127

platform: machine
platform: machine and mount[var-log]

template:
name: mount_option
Expand Down
2 changes: 1 addition & 1 deletion linux_os/guide/system/permissions/partitions/mount_option_var_nodev/rule.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -34,7 +34,7 @@ references:
nist-csf: PR.IP-1,PR.PT-2,PR.PT-3
srg: SRG-OS-000368-GPOS-00154

platform: machine
platform: machine and mount[var]

template:
name: mount_option
Expand Down
4 changes: 2 additions & 2 deletions linux_os/guide/system/permissions/partitions/mount_option_var_noexec/rule.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,7 +6,7 @@ title: 'Add noexec Option to /var'

description: |-
The <tt>noexec</tt> mount option can be used to prevent binaries from being
executed out of <tt>/var</tt>.
executed out of <tt>/var</tt>.
{{{ describe_mount(option="noexec", part="/var") }}}

rationale: |-
Expand All @@ -29,7 +29,7 @@ references:
cis@alinux3: 1.1.3.2
cis@rhel8: 1.1.3.3

platform: machine
platform: machine and mount[var]

template:
name: mount_option
Expand Down
12 changes: 12 additions & 0 deletions shared/applicability/mount.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,7 +6,19 @@ ansible_conditional: {{{ ansible_mount_conditional("{mountpoint}") }}}
template:
name: platform_mount
args:
home:
mountpoint: /home
opt:
mountpoint: /opt
srv:
mountpoint: /srv
tmp:
mountpoint: /tmp
var:
mountpoint: /var
var-log:
mountpoint: /var/log
var-log-audit:
mountpoint: /var/log/audit
var-tmp:
mountpoint: /var/tmp
Loading