Jan,
Doh. The '/selinux/enforce' was RHEL 6 - for Fedora 19 - it's '/sys/fs/selinux/enforce'
-Frank
On 10/04/2013 02:49 PM, fcaviggi@redhat.com wrote:
Jan,
You might consider checking if the '/selinux/enforce' file exists and the file contains '1' (1 is enforcing). That would ensure that SELinux enabled and enforcing the policy.
Regards,
Frank Caviggia
On 10/04/2013 01:11 PM, Jan Lieskovsky wrote:
Introduce new SELinux section of the guide and first rule for it - check if SELinux is enabled in currently booted kernel. Please review. Thank you && Regards, Jan. -- Jan iankko Lieskovsky / Red Hat Security Technologies Team
[shawn@SSG-RHEL6 checks]$ getenforceIs there another crafty way to verify that selinux is *enforcing*? Perhaps checking the value in /etc/selinux instead?
Enforcing
[shawn@SSG-RHEL6 checks]$ cat /proc/mounts | grep selinux
none /selinux selinuxfs rw,relatime 0 0
[shawn@SSG-RHEL6 checks]$ sudo setenforce 0
[sudo] password for shawn:
[shawn@SSG-RHEL6 checks]$ cat /proc/mounts | grep selinux
none /selinux selinuxfs rw,relatime 0 0
[shawn@SSG-RHEL6 self]$ cat /selinux/enforceIf that's a non-reputable source of SELinux enablement, we should add an appropriate XCCDF and OVAL rule to Fedora & RHEL streams.
1
[shawn@SSG-RHEL6 self]$ sudo setenforce 0
[shawn@SSG-RHEL6 self]$ cat /selinux/enforce
0