[gentoo-commits] proj/hardened-docs:master commit in: xml/SCAP/

["Sven Vermeulen" <swift@gentoo.org>]

commit:     378d7c06df134396bfb673430f5c8b85259511c0
Author:     Sven Vermeulen <sven.vermeulen <AT> siphos <DOT> be>
AuthorDate: Fri Dec 20 14:51:53 2013 +0000
Commit:     Sven Vermeulen <swift <AT> gentoo <DOT> org>
CommitDate: Fri Dec 20 14:51:53 2013 +0000
URL:        http://git.overlays.gentoo.org/gitweb/?p=proj/hardened-docs.git;a=commit;h=378d7c06

Add block for GRUB2 password protection (still TODO)

---
 xml/SCAP/gentoo-xccdf.xml | 14 ++++++++++++++
 1 file changed, 14 insertions(+)

diff --git a/xml/SCAP/gentoo-xccdf.xml b/xml/SCAP/gentoo-xccdf.xml
index d38c83f..25621c0 100644
--- a/xml/SCAP/gentoo-xccdf.xml
+++ b/xml/SCAP/gentoo-xccdf.xml
@@ -1388,6 +1388,20 @@ PORTAGE_GPG_DIR="/etc/portage/gpg"
         be (ab)used to work around security mechanisms.
 	</h:p>
       </description>
+      <Group id="xccdf_org.gentoo.dev.swift_group_system-bootloader-grub2pass">
+        <title>Password protect GRUB 2</title>
+	<description>
+	  <h:p>
+	  It is recommended to password-protect the GRUB configuration so that the
+	  boot options cannot be modified during a boot without providing the valid
+	  password.
+	  </h:p>
+	  <h:p>
+	  TODO looks like this has become a lot more difficult to obtain
+	  </h:p>
+	  <reference href="https://help.ubuntu.com/community/Grub2/Passwords">GRUB2 Passwords (Ubuntu wiki)</reference>
+	</description>
+      </Group>
       <Group id="xccdf_org.gentoo.dev.swift_group_system-bootloader-grub1pass">
         <title>Password protect GRUB (legacy)</title>
         <description>