On 9/2/13 10:42 PM, Jeffrey Blank wrote:
Looks like a great improvement to me, please push. At some point in
the future, it seems we'll have to adjust for EFI systems, which (as
Maura has noted elsewhere, right?) seem (rather obnoxiously) to not
use a file linked from /etc/grub.conf.
It's an improvement, in that the OVAL
check no longer errors out. I
believe this was the last OVAL error to be fixed!
In adjusting the existing OVAL, I noted the check fails upon existence
of (selinux|enforcing)=0 anywhere in grub.conf. Meaning, if we set
enforcing=4 the check will still pass, though I believe this is an
invalid option (I couldn't find anything on google regarding this).
I updated the regex to scan for selinux|enforcing=1, however if you have
multiple kernel stanzas, and *any* of them have selinux|enforcing=1, it
will pass even if others have selinux|enforcing=0.
I couldn't figure out how to ensure *all* stanzas have
selinux|enforcing=1.... can anyone help with this?