On 09/03/2013 03:56 PM, Maura Dailey wrote:
> On 09/03/2013 12:46 PM, Shawn Wells wrote:
>> On 9/3/13 12:45 PM, Shawn Wells wrote:
>>> On 9/2/13 10:42 PM, Jeffrey Blank wrote:
>>>> Looks like a great improvement to me, please push. At some point in
>>>> the future, it seems we'll have to adjust for EFI systems, which (as
>>>> Maura has noted elsewhere, right?) seem (rather obnoxiously) to not
>>>> use a file linked from /etc/grub.conf.
>>> It's an improvement, in that the OVAL check no longer errors out. I
>>> believe this was the last OVAL error to be fixed!
>>>
>>> In adjusting the existing OVAL, I noted the check fails upon
>>> existence of (selinux|enforcing)=0 anywhere in grub.conf. Meaning,
>>> if we set enforcing=4 the check will still pass, though I believe
>>> this is an invalid option (I couldn't find anything on google
>>> regarding this).
>>>
>>> I updated the regex to scan for selinux|enforcing=1, however if you
>>> have multiple kernel stanzas, and *any* of them have
>>> selinux|enforcing=1, it will pass even if others have
>>> selinux|enforcing=0.
>>>
>>> I couldn't figure out how to ensure *all* stanzas have
>>> selinux|enforcing=1.... can anyone help with this?
>>
>> oh, p.s., I pushed the fix per jeff's ack:
>>
https://git.fedorahosted.org/cgit/scap-security-guide.git/commit/?id=1253...
>>
>> _______________________________________________
>> scap-security-guide mailing list
>> scap-security-guide(a)lists.fedorahosted.org
>>
https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide
>
>
> A few points. First, I tried selinux=4 on the kernel line and it
> booted properly and was still enforcing. I'll try enforcing=4 next
> and report back if it fails. Second, let's leave it at searching for
> disabled values. That's what the prose says, and there is NO
> requirement to use grub.conf to attempt to enable SELinux. In fact,
> if it's disabled elsewhere, enabling it in grub.conf probably isn't
> even guaranteed to work. I don't know what options override what. I
> suspect SELinux would remain disabled if /etc/selinux/config was set
> to disable it.
>
> Lastly, about the patch, I had an uncommitted patch to the same file
> which is essentially the same with a few small differences. If
> possible, could we change the id names to match the id for the check?
> (test_selinux_bootloader_notdisabled instead of test_selinux_grub,
> for example) Also, could we delete the extra spacing around the
> description so that it's all on one line? Extra spacing inside tags
> could potentially screw something up if it's parsed by an XSLT later.
> I know it screws up the HTML display of XCCDF content.
>
> Thanks,
> - Maura Dailey
> _______________________________________________
> scap-security-guide mailing list
> scap-security-guide(a)lists.fedorahosted.org
>
https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide
Addendum: enforcing=4 has no effect. SELinux is still turned on and
Enforcing.
Thank you!
In regards to the ID name & spacing, I'm going into meetings for the
rest of the day. If you're up to it, I'd say push a patch for these as a
bugfix.... OVAL ID should definitely match XCCDF rule id!