Thank you for your help. I think the links you've included will be very useful as I
become more involved with SCAP. I also realize I will need to become more familiar with
XML but that's an ongoing process I am doing on the side. I do have two more questions
for you that should help me understand what is going on in the oval file. The first is
what is the significance of "ind:" I tried looking into this myself and could
not find an answer. The second has to do with the textfilecontent54_state and object
items. What are these? To me it looks like they are variables being set to the previously
defined object and state variables. I'm sure most of my questions spawn from my lack
of familiarity with the syntax, but I think the documentation you included in your
previous email should help with that!
Again, thank you for taking time to help a newbie!
Luke
________________________________________
From: scap-security-guide-bounces(a)lists.fedorahosted.org
[scap-security-guide-bounces(a)lists.fedorahosted.org] on behalf of Shawn Wells
[shawn(a)redhat.com]
Sent: Monday, August 05, 2013 3:26 PM
To: scap-security-guide(a)lists.fedorahosted.org
Subject: EXTERNAL: Re: MLS question from a new user
On 8/5/13 4:24 PM, Kordell, Luke T wrote:
Hello.
I am new to SCAP and trying to determine how to modify a rule. I have downloaded
the source code and have located an OVAL test I would like to change to suite my purposes.
The file is selinux_policytype.xml. I have chosen this file because I am trying to make
the SELinux enforcement rule pass for an MLS enforcement rather than targeted. My
questions are as follows:
The OVAL document references an object, test, state and variable but does not define
them (as far as I can tell) within the OVAL file. Rather, it appears to be calling them
from somewhere else.
In particular I am referring to these lines.
13 test_ref = "test_selinux_policy"
21 object object_ref = obj_selinux_policy
22 state state_ref = state_selinux_policy
Sooo...... yeaahh. OVAL can be a hot mess. Welcome to the project though!
The first part of the OVAL check is the <definition>, giving various metadata fields
such as the OVAL ID name, affected platforms, etc. Of note you'll see the
<criteria> tag, which defines "what rule must be ran for this OVAL id?"
<definition class="compliance"
id="selinux_policytype" version="1">
<metadata>
<title>Enable SELinux</title>
<affected family="unix">
<platform>Red Hat Enterprise Linux 6</platform>
</affected>
<description>The SELinux policy should be set
appropriately.</description>
</metadata>
<criteria>
<criterion test_ref="test_selinux_policy" />
</criteria>
</definition>
The actual test, "test_selinux_policy," calls out an object to perform a command
upon ("obj_selinux_policy") and the state/value of which it should be set to
("state_selinux_policy"):
<ind:textfilecontent54_test check="all"
check_existence="all_exist"
comment="Tests the value of the ^[\s]*SELINUXTYPE[\s]*=[\s]*([^#]*) expression in
the /etc/selinux/config file"
id="test_selinux_policy" version="1">
<ind:object object_ref="obj_selinux_policy" />
<ind:state state_ref="state_selinux_policy" />
</ind:textfilecontent54_test>
The obj_selinux_policy is a regex pattern against /etc/selinux/config:
<ind:textfilecontent54_object id="obj_selinux_policy"
version="1">
<ind:path>/etc/selinux</ind:path>
<ind:filename>config</ind:filename>
<ind:pattern operation="pattern
match">^[\s]*SELINUXTYPE[\s]*=[\s]*([^#\s]*)</ind:pattern>
<ind:instance datatype="int">1</ind:instance>
</ind:textfilecontent54_object>
And that pattern must match the value of state_selinux_policy:
<ind:textfilecontent54_state id="state_selinux_policy"
version="1">
<ind:subexpression operation="equals" var_check="all"
var_ref="var_selinux_policy_name" />
</ind:textfilecontent54_state>
As you can see, that state calls out a var_ref of "var_selinux_policy_name"
which leads us to your questions:
Finally I think this is the variable I am going to need to change.
var_ref = var_selinux_policy_name
My question are:
1) where are these objects defined, and if it is possible how can I modify them?
Because each baseline (STIG, FISMA, etc) may have different requirements of SELinux, those
variable definitions are found within XCCDF profiles, such as "CS2" and
"stig-rhel6-server." For example, within the common profile (which is inherited
by the STIG) you'll find the lines:
<!-- SELinux state -->
<refine-value idref="var_selinux_policy_name"
selector="targeted"/>
(ref line 262/263:
https://git.fedorahosted.org/cgit/scap-security-guide.git/tree/RHEL6/inpu...)
In your case, you'd want to change "targeted" to "mls"
2) Other than the OVAL website are there any other resources anyone can recommend that can
help me learn this material?
The OVAL specification is online here:
https://oval.mitre.org/language/version5.10.1/
Personally, I had to jump in and ask a bunch of questions. And get a ton of patches nacked
for silly mistakes (.... and of course I no longer make *any* mistakes...). We've
started on a "into to SSG" workbook, which you can find on the wiki page:
https://fedorahosted.org/scap-security-guide/
The workbook mostly focuses on your first scan, and very basic familiarity with the code.
It'd be great to receive patches to the workbook, or just ideas on how to make it
better! SCAP content authoring is still fairly new... if you do find good resources,
please share URLs and perhaps we can create a "getting started with SCAP" link
list off the wiki.