simp / inspec-profile-disa_stig-el7

InSpec Profile for the EL7 DISA STIG
Apache License 2.0
22 stars 46 forks source link

Control `V-72041` should also return a pass when /home is not mounted #54

Open rx294 opened 5 years ago

rx294 commented 5 years ago

control "V-72041" title "File systems that contain user home directories must be mounted to prevent files with the setuid and setgid bit set from being executed."

from the control checktext:

Note: If a separate file system has not been created for the user home
directories (user home directories are mounted under \"/\"), this is not a
finding as the \"nosuid\" option cannot be used on the \"/\" system.

Current test code does not cover this condition:

    describe mount('/home') do
      its('options') { should include 'nosuid' }
    end

Proposed code:

  describe.one do
    describe mount('/home') do
      its('options') { should include 'nosuid' }
    end

    describe etc_fstab.where { mount_point == '/home' } do
      its('entries') { should be_empty }
    end
  end
trevor-vaughan commented 5 years ago

So, I agree with this but technically we should grab all user's home directories using getent passwd and then check that whatever mount point they're on is proper. This will need to have an exclusion list for some users (root, etc...).