>From ba1d017dfd46d426d750bd112ab2aa74a15e0e28 Mon Sep 17 00:00:00 2001 From: Shawn Wells Date: Sun, 10 Nov 2013 03:03:30 -0500 Subject: [PATCH 11/11] Updated OVAL + remediation for selinux_state - Naming scheme updates (selinux_mode->selinux_state, variable to var_selinux_state) - Filename->filepath - Remediation script TESTING [root@SSG-RHEL6 checks]# grep SELINUX= /etc/selinux/config [root@SSG-RHEL6 checks]# ./testcheck.py selinux_state.xml external_variable with id : var_selinux_state Evaluating with OVAL tempfile : /tmp/selinux_state6YAzZT.xml Writing results to : /tmp/selinux_state6YAzZT.xml-results Definition oval:scap-security-guide.testing:def:302: false Evaluation done. [root@SSG-RHEL6 checks]# cd ../fixes/bash/ [root@SSG-RHEL6 bash]# bash selinux_state.sh [root@SSG-RHEL6 bash]# cd - /var/www/html/scap-security-guide/RHEL6/input/checks [root@SSG-RHEL6 checks]# ./testcheck.py selinux_state.xml external_variable with id : var_selinux_state Evaluating with OVAL tempfile : /tmp/selinux_state3ML5ZK.xml Writing results to : /tmp/selinux_state3ML5ZK.xml-results Definition oval:scap-security-guide.testing:def:302: true Evaluation done. --- RHEL6/input/auxiliary/stig_overlay.xml | 2 +- RHEL6/input/checks/selinux_mode.xml | 35 -------------------- RHEL6/input/checks/selinux_state.xml | 35 ++++++++++++++++++++ RHEL6/input/fixes/bash/selinux_state.sh | 8 ++++ RHEL6/input/profiles/CS2.xml | 2 +- RHEL6/input/profiles/common.xml | 4 +- RHEL6/input/profiles/fisma-medium-rhel6-server.xml | 2 +- RHEL6/input/profiles/nist-CL-IL-AL.xml | 4 +- RHEL6/input/profiles/rht-ccp.xml | 4 +- RHEL6/input/profiles/test.xml | 4 +- RHEL6/input/profiles/usgcb-rhel6-server.xml | 4 +- RHEL6/input/system/selinux.xml | 6 ++-- 12 files changed, 59 insertions(+), 51 deletions(-) delete mode 100644 RHEL6/input/checks/selinux_mode.xml create mode 100644 RHEL6/input/checks/selinux_state.xml create mode 100644 RHEL6/input/fixes/bash/selinux_state.sh diff --git a/RHEL6/input/auxiliary/stig_overlay.xml b/RHEL6/input/auxiliary/stig_overlay.xml index 4514436..1d546fb 100644 --- a/RHEL6/input/auxiliary/stig_overlay.xml +++ b/RHEL6/input/auxiliary/stig_overlay.xml @@ -42,7 +42,7 @@ There must be no .rhosts or hosts.equiv files on the system. - + The system must use a Linux Security Module configured to enforce limits on system services. diff --git a/RHEL6/input/checks/selinux_mode.xml b/RHEL6/input/checks/selinux_mode.xml deleted file mode 100644 index affd4ca..0000000 --- a/RHEL6/input/checks/selinux_mode.xml +++ /dev/null @@ -1,35 +0,0 @@ - - - - SELinux Enforcing - - Red Hat Enterprise Linux 6 - - The SELinux state should be enforcing the local policy. - - - - - - - - - - - - - - /etc/selinux - config - ^[\s]*SELINUX[\s]*=[\s]*(.*)[\s]*$ - 1 - - - - - - - - diff --git a/RHEL6/input/checks/selinux_state.xml b/RHEL6/input/checks/selinux_state.xml new file mode 100644 index 0000000..4ba9018 --- /dev/null +++ b/RHEL6/input/checks/selinux_state.xml @@ -0,0 +1,35 @@ + + + + SELinux Enforcing + + Red Hat Enterprise Linux 6 + + The SELinux state should be enforcing the local policy. + + + + + + + + + + + + + + /etc/selinux + config + ^[\s]*SELINUX[\s]*=[\s]*(.*)[\s]*$ + 1 + + + + + + + + diff --git a/RHEL6/input/fixes/bash/selinux_state.sh b/RHEL6/input/fixes/bash/selinux_state.sh new file mode 100644 index 0000000..c7d39ac --- /dev/null +++ b/RHEL6/input/fixes/bash/selinux_state.sh @@ -0,0 +1,8 @@ +source ./templates/support.sh +populate var_selinux_state + +grep -q ^SELINUX= /etc/selinux/config && \ + sed -i "s/SELINUX=.*/SELINUX=$var_selinux_state/g" /etc/selinux/config +if ! [ $? -eq 0 ]; then + echo "SELINUX=$var_selinux_state" >> /etc/selinux/config +fi diff --git a/RHEL6/input/profiles/CS2.xml b/RHEL6/input/profiles/CS2.xml index 32ebb66..f1cc155 100644 --- a/RHEL6/input/profiles/CS2.xml +++ b/RHEL6/input/profiles/CS2.xml @@ -175,7 +175,7 @@ - diff --git a/RHEL6/input/profiles/common.xml b/RHEL6/input/profiles/common.xml index f87d3ec..4134266 100644 --- a/RHEL6/input/profiles/common.xml +++ b/RHEL6/input/profiles/common.xml @@ -14,7 +14,7 @@ + @@ -258,7 +258,7 @@ these should likely be moved out of common. - + diff --git a/RHEL6/input/profiles/fisma-medium-rhel6-server.xml b/RHEL6/input/profiles/fisma-medium-rhel6-server.xml index 7e28b68..00d85e8 100644 --- a/RHEL6/input/profiles/fisma-medium-rhel6-server.xml +++ b/RHEL6/input/profiles/fisma-medium-rhel6-server.xml @@ -17,7 +17,7 @@ + diff --git a/RHEL6/input/profiles/nist-CL-IL-AL.xml b/RHEL6/input/profiles/nist-CL-IL-AL.xml index a02b714..5e9be13 100644 --- a/RHEL6/input/profiles/nist-CL-IL-AL.xml +++ b/RHEL6/input/profiles/nist-CL-IL-AL.xml @@ -22,7 +22,7 @@ assurance." To meet this, SELinux *must* be enabled and configured against either "targeted" or "mls" mode --> - + - diff --git a/RHEL6/input/profiles/rht-ccp.xml b/RHEL6/input/profiles/rht-ccp.xml index ca72dd7..5d0cd48 100644 --- a/RHEL6/input/profiles/rht-ccp.xml +++ b/RHEL6/input/profiles/rht-ccp.xml @@ -2,7 +2,7 @@ Red Hat Corporate Profile for Certified Cloud Providers (RH CCP) This is a *draft* SCAP profile for Red Hat Certified Cloud Providers - + @@ -30,7 +30,7 @@ + - - + --> diff --git a/RHEL6/input/profiles/usgcb-rhel6-server.xml b/RHEL6/input/profiles/usgcb-rhel6-server.xml index 6eab024..5fcee18 100644 --- a/RHEL6/input/profiles/usgcb-rhel6-server.xml +++ b/RHEL6/input/profiles/usgcb-rhel6-server.xml @@ -108,8 +108,8 @@ - - diff --git a/RHEL6/input/system/selinux.xml b/RHEL6/input/system/selinux.xml index 80f4fc0..3b6b338 100644 --- a/RHEL6/input/system/selinux.xml +++ b/RHEL6/input/system/selinux.xml @@ -58,7 +58,7 @@ necessary to check grub.conf to ensure that this has not been done and to protect the boot process. - + SELinux state enforcing - SELinux security policy is enforced.
permissive - SELinux prints warnings instead of enforcing. @@ -103,7 +103,7 @@ the chances that it will remain off during system operation. - + Ensure SELinux State is Enforcing The SELinux state should be set to enforcing at system boot time. In the file /etc/selinux/config, add or correct the @@ -121,7 +121,7 @@ prevent them from causing damage to the system or further elevating their privileges. - + -- 1.7.1