Merge pull request #9984 from rumch-se/partition_for_dev_shm

Added rule partition_for_dev_shm

controls/cis_sle12.yml

@@ -87,7 +87,9 @@ controls:
     levels:
     - l1_server
     - l1_workstation
-    status: manual # rule is missing
+    status: automated
+    rules:
+    - partition_for_dev_shm
 
   - id: 1.1.7
     title: Ensure noexec option set on /dev/shm partition (Automated)

controls/cis_sle15.yml

@@ -96,7 +96,9 @@ controls:
     levels:
       - l1_server
       - l1_workstation
-    status: manual # rule is missing
+    status: automated
+    rules:
+      - partition_for_dev_shm
 
   - id: 1.1.7
     title: Ensure noexec option set on /dev/shm partition (Automated)

linux_os/guide/system/software/disk_partitioning/partition_for_dev_shm/rule.yml

@@ -0,0 +1,41 @@
+documentation_complete: true
+
+title: 'Ensure /dev/shm is configured'
+
+description: |-
+    The <tt>/dev/shm</tt> is a traditional shared memory concept. 
+    One program will create a memory portion, which other processes 
+    (if permitted) can access. If <tt>/dev/shm</tt> is not configured, 
+    tmpfs will be mounted to /dev/shm by systemd.
+
+rationale: |-
+    Any user can upload and execute files inside the <tt>/dev/shm</tt> similar to 
+    the <tt>/tmp</tt> partition. Configuring <tt>/dev/shm</tt> allows an administrator 
+    to set the noexec option on the mount, making /dev/shm useless for an attacker to 
+    install executable code. It would also prevent an attacker from establishing a 
+    hardlink to a system setuid program and wait for it to be updated. Once the program 
+    was updated, the hardlink would be broken and the attacker would have his own copy 
+    of the program. If the program happened to have a security vulnerability, the attacker 
+    could continue to exploit the known flaw.
+
+severity: low
+
+identifiers:
+    cce@sle12: CCE-92319-3
+    cce@sle15: CCE-92477-9
+
+references:
+    cis@sle12: 1.1.6
+    cis@sle15: 1.1.6
+
+{{{ complete_ocil_entry_separate_partition(part="/dev/shm") }}}
+
+fixtext: '{{{ fixtext_separate_partition(part="/dev/shm") }}}'
+
+platform: machine
+
+template:
+    name: mount
+    vars:
+        mountpoint: /dev/shm
+        min_size: 2147483648

shared/references/cce-sle12-avail.txt

@@ -1,4 +1,3 @@
-CCE-92319-3
 CCE-92321-9
 CCE-92324-3
 CCE-92326-8

shared/references/cce-sle15-avail.txt

@@ -1,4 +1,3 @@
-CCE-92477-9
 CCE-92479-5
 CCE-92481-1
 CCE-92483-7