From luke.t.kordell at lmco.com Thu Aug 20 11:34:45 2015 Content-Type: multipart/mixed; boundary="===============3907380697719435964==" MIME-Version: 1.0 From: Kordell, Luke T To: scap-security-guide at lists.fedorahosted.org Subject: RE: EXTERNAL: Re: MLS question from a new user Date: Mon, 05 Aug 2013 22:02:48 +0000 Message-ID: In-Reply-To: 5200188A.7040602@redhat.com --===============3907380697719435964== Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Thank you for your help. I think the links you've included will be very use= ful as I become more involved with SCAP. I also realize I will need to beco= me more familiar with XML but that's an ongoing process I am doing on the s= ide. I do have two more questions for you that should help me understand wh= at is going on in the oval file. The first is what is the significance of "= ind:" I tried looking into this myself and could not find an answer. The se= cond has to do with the textfilecontent54_state and object items. What are = these? To me it looks like they are variables being set to the previously d= efined object and state variables. I'm sure most of my questions spawn from= my lack of familiarity with the syntax, but I think the documentation you = included in your previous email should help with that! = Again, thank you for taking time to help a newbie! = Luke = ________________________________________ From: scap-security-guide-bounces(a)lists.fedorahosted.org [scap-security-g= uide-bounces(a)lists.fedorahosted.org] on behalf of Shawn Wells [shawn(a)re= dhat.com] Sent: Monday, August 05, 2013 3:26 PM To: scap-security-guide(a)lists.fedorahosted.org Subject: EXTERNAL: Re: MLS question from a new user On 8/5/13 4:24 PM, Kordell, Luke T wrote: Hello. I am new to SCAP and trying to determine how to modify a rule. I hav= e downloaded the source code and have located an OVAL test I would like to = change to suite my purposes. The file is selinux_policytype.xml. I have cho= sen this file because I am trying to make the SELinux enforcement rule pass= for an MLS enforcement rather than targeted. My questions are as follows: The OVAL document references an object, test, state and variable but d= oes not define them (as far as I can tell) within the OVAL file. Rather, it= appears to be calling them from somewhere else. In particular I am referring to these lines. 13 test_ref =3D "test_selinux_policy" 21 object object_ref =3D obj_selinux_policy 22 state state_ref =3D state_selinux_policy Sooo...... yeaahh. OVAL can be a hot mess. Welcome to the project though! The first part of the OVAL check is the , giving various metada= ta fields such as the OVAL ID name, affected platforms, etc. Of note you'll= see the tag, which defines "what rule must be ran for this OVAL= id?" Enable SELinux Red Hat Enterprise Linux 6 The SELinux policy should be set appropriately. The actual test, "test_selinux_policy," calls out an object to perform a co= mmand upon ("obj_selinux_policy") and the state/value of which it should be= set to ("state_selinux_policy"): The obj_selinux_policy is a regex pattern against /etc/selinux/config: /etc/selinux config ^[\s]*SELINUXTYPE[\s]*=3D[\s]*= ([^#\s]*) 1 And that pattern must match the value of state_selinux_policy: As you can see, that state calls out a var_ref of "var_selinux_policy_name"= which leads us to your questions: Finally I think this is the variable I am going to need to change. var_ref =3D var_selinux_policy_name My question are: 1) where are these objects defined, and if it is possible how can I modify = them? Because each baseline (STIG, FISMA, etc) may have different requirements of= SELinux, those variable definitions are found within XCCDF profiles, such = as "CS2" and "stig-rhel6-server." For example, within the common profile (w= hich is inherited by the STIG) you'll find the lines: (ref line 262/263: https://git.fedorahosted.org/cgit/scap-security-guide.git/tree/RHEL6/input/= profiles/common.xml) In your case, you'd want to change "targeted" to "mls" 2) Other than the OVAL website are there any other resources anyone can rec= ommend that can help me learn this material? The OVAL specification is online here: https://oval.mitre.org/language/version5.10.1/ Personally, I had to jump in and ask a bunch of questions. And get a ton of= patches nacked for silly mistakes (.... and of course I no longer make *an= y* mistakes...). We've started on a "into to SSG" workbook, which you can f= ind on the wiki page: https://fedorahosted.org/scap-security-guide/ The workbook mostly focuses on your first scan, and very basic familiarity = with the code. It'd be great to receive patches to the workbook, or just id= eas on how to make it better! SCAP content authoring is still fairly new...= if you do find good resources, please share URLs and perhaps we can create= a "getting started with SCAP" link list off the wiki. --===============3907380697719435964==--