On Jun 11, 2012, at 6:13 PM, Jeffrey Blank <blank(a)eclipse.ncsc.mil> wrote:
Signed-off-by: Jeffrey Blank <blank(a)eclipse.ncsc.mil>
rhel6/src/input/system/selinux.xml | 116 +++++++-----------------------------
1 files changed, 22 insertions(+), 94 deletions(-)
diff --git a/rhel6/src/input/system/selinux.xml b/rhel6/src/input/system/selinux.xml
index 803cdf9..72e8a7d 100644
@@ -3,60 +3,20 @@
<description>SELinux is a feature of the Linux kernel which can be
used to guard against misconfigured or compromised programs.
SELinux enforces the idea that programs should be limited in what
-files they can access and what actions they can take.
+resources they can access and what actions they can take.
<br /><br />
-The default SELinux policy, as configured on RHEL6, has been
-sufficiently developed and debugged that it should be usable on
-almost any Red Hat machine with minimal configuration and a small
-amount of system administrator training. This policy prevents
-system services — including most of the common network-visible
-services such as mail servers, ftp servers, and DNS servers — from
-accessing files which those services have no valid reason to
-access. This action alone prevents a huge amount of possible damage
-from network attacks against services, from trojaned software, and
-<br /><br />
-This guide recommends that SELinux be enabled using the
-default (targeted) policy on every Red Hat system, unless that
-system has requirements which make a stronger policy
+Support for SELinux is provided out-of-the-box on RHEL. The default SELinux
+policy included with RHEL, called <tt>targeted</tt>, should be usable with
+minimal configuration and a small amount of system administrator training. This
+policy prevents system services — including most of the common network-visible
+services such as mail servers, ftp servers, and DNS servers — from accessing
+files which those services have no valid reason to access. This action alone
+can prevent serious damage from attacks which may compromise system services.
+Creation and deployment of custom SELinux policies can allow satisfaction of
+even stronger security goals, though this is generally done for systems that
+fill specialized, security-critical roles instead of general purpose systems.
-<description>Edit the file <tt>/etc/selinux/config</tt>. Add or
-Edit the file <tt>/etc/grub.conf</tt>. Ensure that the following
-arguments DO NOT appear on any kernel command line in the file:
-The directive <tt>SELINUX=enforcing</tt> enables SELinux at boot time.
-If SELinux is suspected of involvement with boot-time problems
-(unlikely), it is possible to boot into the warning-only mode
-<tt>SELINUX=permissive</tt> for debugging purposes. Make certain to change
-the mode back to enforcing after debugging, set the filesystems to
-be relabelled for consistency using the command <tt>touch
-/.autorelabel</tt>, and reboot.
-<br /><br />
-However, the RHEL6 default SELinux configuration should be
-sufficiently reasonable that most systems will boot without serious
-problems. Some applications that require deep or unusual system
-privileges, such as virtual machine software, may not be compatible
-with SELinux in its default configuration. However, this should be
-uncommon, and SELinux's application support continues to improve.
-In other cases, SELinux may reveal unusual or insecure program
-behavior by design.
-<br /><br />
-The directive <tt>SELINUXTYPE=targeted</tt> configures SELinux to use
-the default targeted policy.
-<br /><br />
-The SELinux boot mode specified in <tt>/etc/selinux/config</tt> can be
-overridden by command-line arguments passed to the kernel. It is
-necessary to check <tt>grub.conf</tt> to ensure that this has not been
-and to protect the boot process.
<Value id="var_selinux_state_name" type="string"
@@ -82,7 +42,7 @@ and to protect the boot process.
-<title>Ensure SELinux Not Disabled in /etc/grub.conf</title>
+<title>Ensure SELinux Not Disabled at Boot</title>
<description>SELinux can be disabled at boot time by an argument
To ensure that SELinux is not disabled at boot time, ensure that
<tt>selinux=0</tt> is not
@@ -99,15 +59,21 @@ the chances that it remain off during system operation.
-<title>Check SELinux State</title>
+<title>Ensure SELinux in Enforcing Mode</title>
<description>The SELinux state should be set to <tt>enforcing</tt>
normal system operation. To ensure the system is configured to
boot into enforcing mode, add or correct the following line in
+If SELinux is suspected of involvement with boot-time problems
+(unlikely), it is possible to boot into the warning-only mode
+<tt>SELINUX=permissive</tt> for debugging purposes. Make certain to change
+the mode back to enforcing after debugging, set the filesystems to
+be relabelled for consistency using the command <tt>touch
+/.autorelabel</tt>, and reboot.
-Setting the SELinux state to enforcing ensures that SELinux is able to confine
+Setting the SELinux state to <tt>enforcing</tt> ensures that SELinux is able
potentially compromised processes to the security policy, which is designed to
prevent them from causing damage to the system or further elevating their
@@ -118,7 +84,7 @@ privileges.
-<title>Check SELinux Policy</title>
+<title>Ensure SELinux Policy Selected</title>
<description>The SELinux <tt>targeted</tt> policy is appropriate for
general-purpose desktops and servers, as well as systems in many other roles.
To configure the system to use this policy,
@@ -137,7 +103,6 @@ targeted for exploitation, such as network services or system
<ref nist="CM-6, CM-7" />
@@ -159,43 +124,6 @@ of file contexts created by some programs.</rationale>
-<title>Disable Unnecessary SELinux Daemons</title>
-<description>Several daemons are installed by default as part of
-the RHEL6 SELinux support mechanism. These daemons may improve the
-system's ability to enforce SELinux policy in a useful fashion, but
-may also represent unnecessary code running on the machine,
-increasing system risk. If these daemons are not needed on your
-system, they should be disabled.</description>
-<title>Disable MCS Translation Service (mcstrans) if
-<description>Unless there is some overriding need for the
-convenience of category label translation, disable the MCS
-<pre># chkconfig mcstrans off</pre>
-The mcstransd daemon provides the category label translation
-information defined in <tt>/etc/selinux/targeted/setrans.conf</tt> to
-client processes which request this information.
-<br /><br />
-Category labelling is unlikely to be used except in sites
-with special requirements. Therefore, it should be disabled in
-order to reduce the amount of potentially vulnerable code running
-on the system. See Section 2.4.6 for more information about systems
-which use category labelling.</description>
-<title>Disable mcstrans Service</title>
-<description>The MCS Translation Service (mcstrans) should be
-<ident cce="3668-1" />
-<oval id="service_mcstrans_disabled" />
-<ref nist="CM-6, CM-7" />
<title>Ensure No Daemons are Unconfined by SELinux</title>
@@ -222,7 +150,7 @@ Device files are used for communication with important
system resources. SELinux contexts should exist for these.
<br /><br />
To check for unlabeled device files, run the following command:
-<pre># ls -Z | grep unlabeled_t</pre>
+<pre># ls -RZ /dev | grep unlabeled_t</pre>
It should produce no output in a well-configured system.
scap-security-guide mailing list