From mboxrd@z Thu Jan  1 00:00:00 1970
Return-Path: <gentoo-commits+bounces-651221-garchives=archives.gentoo.org@lists.gentoo.org>
Received: from lists.gentoo.org (pigeon.gentoo.org [208.92.234.80])
	by finch.gentoo.org (Postfix) with ESMTP id A895A1387B1
	for <garchives@archives.gentoo.org>; Fri, 20 Dec 2013 13:56:05 +0000 (UTC)
Received: from pigeon.gentoo.org (localhost [127.0.0.1])
	by pigeon.gentoo.org (Postfix) with SMTP id A2981E0AE8;
	Fri, 20 Dec 2013 13:56:04 +0000 (UTC)
Received: from smtp.gentoo.org (smtp.gentoo.org [140.211.166.183])
	(using TLSv1 with cipher AECDH-AES256-SHA (256/256 bits))
	(No client certificate requested)
	by pigeon.gentoo.org (Postfix) with ESMTPS id EF4DCE0AD4
	for <gentoo-commits@lists.gentoo.org>; Fri, 20 Dec 2013 13:56:03 +0000 (UTC)
Received: from hornbill.gentoo.org (hornbill.gentoo.org [94.100.119.163])
	(using TLSv1 with cipher AECDH-AES256-SHA (256/256 bits))
	(No client certificate requested)
	by smtp.gentoo.org (Postfix) with ESMTPS id AC9F933F64D
	for <gentoo-commits@lists.gentoo.org>; Fri, 20 Dec 2013 13:56:02 +0000 (UTC)
Received: from localhost.localdomain (localhost [127.0.0.1])
	by hornbill.gentoo.org (Postfix) with ESMTP id 5EEF6E575A
	for <gentoo-commits@lists.gentoo.org>; Fri, 20 Dec 2013 13:56:01 +0000 (UTC)
From: "Sven Vermeulen" <swift@gentoo.org>
To: gentoo-commits@lists.gentoo.org
Content-Transfer-Encoding: 8bit
Content-type: text/plain; charset=UTF-8
Reply-To: gentoo-dev@lists.gentoo.org, "Sven Vermeulen" <swift@gentoo.org>
Message-ID: <1387544825.117fc65c426f7342ca2f947f8f4a286be0f341aa.swift@gentoo>
Subject: [gentoo-commits] proj/hardened-docs:master commit in: xml/SCAP/
X-VCS-Repository: proj/hardened-docs
X-VCS-Files: xml/SCAP/gentoo-oval.xml xml/SCAP/gentoo-xccdf.xml
X-VCS-Directories: xml/SCAP/
X-VCS-Committer: swift
X-VCS-Committer-Name: Sven Vermeulen
X-VCS-Revision: 117fc65c426f7342ca2f947f8f4a286be0f341aa
X-VCS-Branch: master
Date: Fri, 20 Dec 2013 13:56:01 +0000 (UTC)
Precedence: bulk
List-Post: <mailto:gentoo-commits@lists.gentoo.org>
List-Help: <mailto:gentoo-commits+help@lists.gentoo.org>
List-Unsubscribe: <mailto:gentoo-commits+unsubscribe@lists.gentoo.org>
List-Subscribe: <mailto:gentoo-commits+subscribe@lists.gentoo.org>
List-Id: Gentoo Linux mail <gentoo-commits.gentoo.org>
X-BeenThere: gentoo-commits@lists.gentoo.org
X-Archives-Salt: ea158ed3-eac2-4aee-81ac-03af489eb65e
X-Archives-Hash: 4cae0db87dea199ddfefd83892795a70

commit:     117fc65c426f7342ca2f947f8f4a286be0f341aa
Author:     Sven Vermeulen <sven.vermeulen <AT> siphos <DOT> be>
AuthorDate: Fri Dec 20 13:07:05 2013 +0000
Commit:     Sven Vermeulen <swift <AT> gentoo <DOT> org>
CommitDate: Fri Dec 20 13:07:05 2013 +0000
URL:        http://git.overlays.gentoo.org/gitweb/?p=proj/hardened-docs.git;a=commit;h=117fc65c

Add /var and /home quota mount options check

---
 xml/SCAP/gentoo-oval.xml  | 58 +++++++++++++++++++++++++++++++++++++++++++++++
 xml/SCAP/gentoo-xccdf.xml | 22 ++++++++++++++++++
 2 files changed, 80 insertions(+)

diff --git a/xml/SCAP/gentoo-oval.xml b/xml/SCAP/gentoo-oval.xml
index 693d59f..3fb4adb 100644
--- a/xml/SCAP/gentoo-oval.xml
+++ b/xml/SCAP/gentoo-oval.xml
@@ -427,6 +427,36 @@
     </criteria>
   </definition>
 
+  <definition id="oval:org.gentoo.dev.swift:def:25" version="1" class="compliance">
+    <metadata>
+      <title>/var is mounted with quota option(s)</title>
+      <affected family="unix">
+        <platform>Gentoo Linux</platform>
+      </affected>
+      <description>
+        The /var mount should be mounted with usrquota or grpquota mount option.
+      </description>
+    </metadata>
+    <criteria>
+      <criterion test_ref="oval:org.gentoo.dev.swift:tst:26" comment="/var is mounted with usrquota or grpquota" />
+    </criteria>
+  </definition>
+
+  <definition id="oval:org.gentoo.dev.swift:def:26" version="1" class="compliance">
+    <metadata>
+      <title>/home is mounted with quota option(s)</title>
+      <affected family="unix">
+        <platform>Gentoo Linux</platform>
+      </affected>
+      <description>
+        The /home mount should be mounted with usrquota or grpquota mount option.
+      </description>
+    </metadata>
+    <criteria>
+      <criterion test_ref="oval:org.gentoo.dev.swift:tst:27" comment="/home is mounted with usrquota or grpquota" />
+    </criteria>
+  </definition>
+
 </definitions>
 
 <tests>
@@ -632,6 +662,24 @@
     <unix-def:object object_ref="oval:org.gentoo.dev.swift:obj:15" />
   </unix-def:file_test>
 
+  <lin-def:partition_test id="oval:org.gentoo.dev.swift:tst:26"
+    version="1" check="all" check_existence="all_exist"
+    comment="Tests that /var is mounted with usrquota or grpquota option">
+    <!-- /var file system -->
+    <lin-def:object object_ref="oval:org.gentoo.dev.swift:obj:16" />
+    <!-- "usrquota" or "grpquota" mount option -->
+    <lin-def:state state_ref="oval:org.gentoo.dev.swift:ste:7" />
+  </lin-def:partition_test>
+
+  <lin-def:partition_test id="oval:org.gentoo.dev.swift:tst:27"
+    version="1" check="all" check_existence="all_exist"
+    comment="Tests that /home is mounted with usrquota or grpquota option">
+    <!-- /home file system -->
+    <lin-def:object object_ref="oval:org.gentoo.dev.swift:obj:2" />
+    <!-- "usrquota" or "grpquota" mount option -->
+    <lin-def:state state_ref="oval:org.gentoo.dev.swift:ste:7" />
+  </lin-def:partition_test>
+
 </tests>
 
 <objects>
@@ -719,6 +767,11 @@
     <unix-def:filepath>/etc/at/at.allow</unix-def:filepath>
   </unix-def:file_object>
 
+  <lin-def:partition_object id="oval:org.gentoo.dev.swift:obj:16"
+    version="1" comment="The /var file system">
+    <lin-def:mount_point>/var</lin-def:mount_point>
+  </lin-def:partition_object>
+
 </objects>
 
 <states>
@@ -753,6 +806,11 @@
     <ind-def:text datatype="string" operation="pattern match" entity_check="all">su[[:digit:]]+:S:[\S]+:(/sbin/rc single|/sbin/sulogin)</ind-def:text>
   </ind-def:textfilecontent54_state>
 
+  <lin-def:partition_state id="oval:org.gentoo.dev.swift:ste:7"
+    version="1" comment="The file system is mounted with quota support option">
+    <lin-def:mount_options entity_check="at least one" operation="pattern match">(usr|grp)quota</lin-def:mount_options>
+  </lin-def:partition_state>
+
 </states>
 
 <!--

diff --git a/xml/SCAP/gentoo-xccdf.xml b/xml/SCAP/gentoo-xccdf.xml
index e51a0ab..1057fb3 100644
--- a/xml/SCAP/gentoo-xccdf.xml
+++ b/xml/SCAP/gentoo-xccdf.xml
@@ -73,6 +73,10 @@
     <select idref="xccdf_org.gentoo.dev.swift_rule_partition-devshm-noexec" selected="true" />
     <!-- Kernel quota support must be enabled -->
     <select idref="xccdf_org.gentoo.dev.swift_rule_kernel-quota" selected="true" />
+    <!-- /var is mounted with usrquota or grpquota -->
+    <select idref="xccdf_org.gentoo.dev.swift_rule_var-quota" selected="true" />
+    <!-- /home is mounted with usrquota or grpquota -->
+    <select idref="xccdf_org.gentoo.dev.swift_rule_home-quota" selected="true" />
     <!-- No telnetd process is running -->
     <select idref="xccdf_org.gentoo.dev.swift_rule_telnetd-notrunning" selected="true" />
     <!-- No ftpd process is running -->
@@ -949,6 +953,24 @@ mount -o remount,noexec /dev/shm
             <check-content-ref name="oval:org.gentoo.dev.swift:def:18" href="gentoo-oval.xml" />
           </check>
         </Rule>
+	<Rule id="xccdf_org.gentoo.dev.swift_rule_var-quota" selected="false" severity="low" weight="1.7">
+	  <title>The /var file system is mounted with usrquota or grpquota</title>
+	  <fixtext fixref="xccdf_org.gentoo.dev.swift_fix_var-quota">Mount /var with usrquota and/or grpquota</fixtext>
+	  <fix id="xccdf_org.gentoo.dev.swift_fix_partition-var-quota"
+               system="urn:xccdf:fix:system:commands"
+	       platform="cpe:/o:gentoo:linux" complexity="low" disruption="low" reboot="false">
+mount -o remount,usrquota,grpquota /var
+          </fix>
+	</Rule>
+	<Rule id="xccdf_org.gentoo.dev.swift_rule_home-quota" selected="false" severity="low" weight="1.7">
+	  <title>The /home file system is mounted with usrquota or grpquota</title>
+	  <fixtext fixref="xccdf_org.gentoo.dev.swift_fix_home-quota">Mount /home with usrquota and/or grpquota</fixtext>
+	  <fix id="xccdf_org.gentoo.dev.swift_fix_partition-home-quota"
+	       system="urn:xccdf:fix:system:commands"
+	       platform="cpe:/o:gentoo:linux" complexity="low" disruption="low" reboot="false">
+mount -o remount,usrquota,grpquota /home
+          </fix>
+	</Rule>
       </Group> <!-- system-fs-quotas -->
     </Group> <!-- system-fs -->
     <Group id="xccdf_org.gentoo.dev.swift_group_system-services">