For now we have decided to postpone submission
of this proposal till the doubt if SCAP security
guide should check just system configuration,
or also the system runtime settings too, is solved
(and focused on work on other sections of the guide).
We can propose new version, that in the default run would
check just system configuration settings, and mark runtime
checks as 'notapplicable' in the default version (to be
set up / enabled by actual Fedora SCAP content users
in case of desire / requirement).
But would be good to know your general opinion on the
topic (if SSG should check just configuration, or also
runtime settings) to avoid this when submitting proposals
for new rules in the future.
Thank you && Regards, Jan.
--
Jan iankko Lieskovsky / Red Hat Security Technologies Team
----- Original Message -----
From: "Jan Lieskovsky" <jlieskov(a)redhat.com>
To: scap-security-guide(a)lists.fedorahosted.org
Sent: Friday, October 4, 2013 7:11:09 PM
Subject: [PATCH] [Fedora] Introduce 'Ensure SELinux Not Disabled in Currently Running
Kernel' rule
Introduce new SELinux section of the guide and first rule
for it - check if SELinux is enabled in currently
booted kernel.
Please review.
Thank you && Regards, Jan.
--
Jan iankko Lieskovsky / Red Hat Security Technologies Team