>From 1253b6e4048f575d0be802b8db0c1a0964ec6619 Mon Sep 17 00:00:00 2001 From: Shawn Wells Date: Sun, 1 Sep 2013 11:19:48 -0400 Subject: [PATCH] [bugfix] Updated selinux_bootloader_notdisabled per ticket 391 - regex wrong - obj/test names updated - oval signoff [root@rhel6 checks]# vim /etc/grub.conf ; grep enforcing=0 /etc/grub.conf ; ./testcheck.py selinux_bootloader_notdisabled.xml kernel /vmlinuz-2.6.32-358.6.1.el6.x86_64 ro root=/dev/mapper/vg_rhel6-lv_root rd_LVM_LV=vg_rhel6/lv_root rd_LVM_LV=vg_rhel6/lv_swap rd_NO_LUKS rd_NO_MD rd_NO_DM LANG=en_US.UTF-8 SYSFONT=latarcyrheb-sun16 KEYBOARDTYPE=pc KEYTABLE=us audit=1 crashkernel=auto rhgb quiet g enforcing=0 kernel /vmlinuz-2.6.32-358.2.1.el6.x86_64 ro root=/dev/mapper/vg_rhel6-lv_root rd_LVM_LV=vg_rhel6/lv_root rd_LVM_LV=vg_rhel6/lv_swap rd_NO_LUKS rd_NO_MD rd_NO_DM LANG=en_US.UTF-8 SYSFONT=latarcyrheb-sun16 KEYBOARDTYPE=pc KEYTABLE=us audit=1 crashkernel=auto rhgb quiet g enforcing=0 Evaluating with OVAL tempfile : /tmp/selinux_bootloader_notdisabledyJ5ssL.xml Writing results to : /tmp/selinux_bootloader_notdisabledyJ5ssL.xml-results Definition oval:scap-security-guide.testing:def:217: false Evaluation done. [root@rhel6 checks]# vim /etc/grub.conf ; grep enforcing=0 /etc/grub.conf ; ./testcheck.py selinux_bootloader_notdisabled.xml Evaluating with OVAL tempfile : /tmp/selinux_bootloader_notdisabledtSgRwM.xml Writing results to : /tmp/selinux_bootloader_notdisabledtSgRwM.xml-results Definition oval:scap-security-guide.testing:def:217: true Evaluation done. --- .../checks/selinux_bootloader_notdisabled.xml | 28 ++++++++++++-------- 1 files changed, 17 insertions(+), 11 deletions(-) diff --git a/RHEL6/input/checks/selinux_bootloader_notdisabled.xml b/RHEL6/input/checks/selinux_bootloader_notdisabled.xml index a064052..368902d 100644 --- a/RHEL6/input/checks/selinux_bootloader_notdisabled.xml +++ b/RHEL6/input/checks/selinux_bootloader_notdisabled.xml @@ -1,23 +1,29 @@ - + - Enable SELinux + Enable SELinux in /etc/grub.conf Red Hat Enterprise Linux 6 - SELinux should be enabled + + Check if selinux=0 OR enforcing=0 within /etc/grub.conf lines, fail if found. + + - + - - + + - - /boot/grub/grub.conf - ^\s*kernel\s+.*(selinux|enforcing)=0.*$ - 1 + + /etc/grub.conf + ^[\s]*kernel[\s]+.*(selinux|enforcing)=0.*$ + 1 -- 1.7.1