Hi Shawn,
I assume you need to define a scope whether runtime settings should be
covered or not. My assumption was that the guide is about configuration
settings.
http://scap-securityguide.rhcloud.com/RHEL6/output/rhel6-guide.html
"This guide presents a catalog of security-relevant configuration
settings ... "
Peter.
On 10/07/2013 04:40 AM, Shawn Wells wrote:
On 10/5/13 12:07 PM, fcaviggi(a)redhat.com wrote:
> Shawn,
>
> If these files exist and contain '1':
>
> '/selinux/enforce' - RHEL 6
> '/sys/fs/selinux/enforce' - Fedora 19
>
> Then SELinux is enabled and enforcing - the filesystem can only exist
> if SELinux is enabled, the contents are the enforcement status.
So then, should we update the existing SELinux OVAL to check for both
the static /etc/selinux/config *and* runtime /selinux/enforce values?
_______________________________________________
scap-security-guide mailing list
scap-security-guide(a)lists.fedorahosted.org
https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide