>From 0572166a383b68ad56ef5234d0e859de8dc7af87 Mon Sep 17 00:00:00 2001 From: Shawn Wells Date: Mon, 3 Dec 2012 19:12:30 -0500 Subject: [PATCH] DISA FSO requested updates to RHEL6/input/system/selinux.xml DISA FSO requested updates to RHEL6/input/system/selinux.xml Closing ticket https://fedorahosted.org/scap-security-guide/ticket/160 --- RHEL6/input/system/selinux.xml | 7 +++---- 1 files changed, 3 insertions(+), 4 deletions(-) diff --git a/RHEL6/input/system/selinux.xml b/RHEL6/input/system/selinux.xml index 58c4c5c..f46d2c2 100644 --- a/RHEL6/input/system/selinux.xml +++ b/RHEL6/input/system/selinux.xml @@ -117,7 +117,7 @@ Check the file /etc/selinux/config and ensure the following line appear
SELINUX=enforcing
-Setting the SELinux state to enforcing ensures that SELinux is able to confine +Setting the SELinux state to enforcing ensures SELinux is able to confine potentially compromised processes to the security policy, which is designed to prevent them from causing damage to the system or further elevating their privileges. @@ -145,7 +145,7 @@ Check the file /etc/selinux/config and ensure the following line appear Setting the SELinux policy to targeted or a more specialized policy -ensures that the system will confine processes that are likely to be +ensures the system will confine processes that are likely to be targeted for exploitation, such as network or system services. @@ -155,13 +155,12 @@ targeted for exploitation, such as network or system services. - Enable the SELinux Context Restoration Service (restorecond) The restorecond service utilizes inotify to look for the creation of new files listed in the /etc/selinux/restorecond.conf configuration file. When a file is -created, restorecond ensures that the file receives the proper SELinux +created, restorecond ensures the file receives the proper SELinux security context. -- 1.7.1