[PATCH] prose cleanup of SELinux discussion

Jeffrey Blank blank at eclipse.ncsc.mil
Mon Jun 11 22:04:36 UTC 2012


Signed-off-by: Jeffrey Blank <blank at eclipse.ncsc.mil>
---
 rhel6/src/input/system/selinux.xml |  116 +++++++-----------------------------
 1 files changed, 22 insertions(+), 94 deletions(-)

diff --git a/rhel6/src/input/system/selinux.xml b/rhel6/src/input/system/selinux.xml
index 803cdf9..72e8a7d 100644
--- a/rhel6/src/input/system/selinux.xml
+++ b/rhel6/src/input/system/selinux.xml
@@ -3,60 +3,20 @@
 <description>SELinux is a feature of the Linux kernel which can be
 used to guard against misconfigured or compromised programs.
 SELinux enforces the idea that programs should be limited in what
-files they can access and what actions they can take.
+resources they can access and what actions they can take.
 <br /><br />
-The default SELinux policy, as configured on RHEL6, has been
-sufficiently developed and debugged that it should be usable on
-almost any Red Hat machine with minimal configuration and a small
-amount of system administrator training. This policy prevents
-system services — including most of the common network-visible
-services such as mail servers, ftp servers, and DNS servers — from
-accessing files which those services have no valid reason to
-access. This action alone prevents a huge amount of possible damage
-from network attacks against services, from trojaned software, and
-so forth.
-<br /><br />
-This guide recommends that SELinux be enabled using the
-default (targeted) policy on every Red Hat system, unless that
-system has requirements which make a stronger policy
-appropriate.
+Support for SELinux is provided out-of-the-box on RHEL. The default SELinux
+policy included with RHEL, called <tt>targeted</tt>, should be usable with
+minimal configuration and a small amount of system administrator training. This
+policy prevents system services — including most of the common network-visible
+services such as mail servers, ftp servers, and DNS servers — from accessing
+files which those services have no valid reason to access. This action alone
+can prevent serious damage from attacks which may compromise system services.
+Creation and deployment of custom SELinux policies can allow satisfaction of
+even stronger security goals, though this is generally done for systems that
+fill specialized, security-critical roles instead of general purpose systems.
 </description>
 
-<Group id="enabling_selinux">
-<title>Enable SELinux</title>
-<description>Edit the file <tt>/etc/selinux/config</tt>. Add or correct the
-following lines:
-<pre>SELINUX=enforcing
-SELINUXTYPE=targeted</pre>
-Edit the file <tt>/etc/grub.conf</tt>. Ensure that the following
-arguments DO NOT appear on any kernel command line in the file:
-<pre>selinux=0
-enforcing=0</pre>
-The directive <tt>SELINUX=enforcing</tt> enables SELinux at boot time.
-If SELinux is suspected of involvement with boot-time problems
-(unlikely), it is possible to boot into the warning-only mode
-<tt>SELINUX=permissive</tt> for debugging purposes. Make certain to change
-the mode back to enforcing after debugging, set the filesystems to
-be relabelled for consistency using the command <tt>touch
-/.autorelabel</tt>, and reboot.
-<br /><br />
-However, the RHEL6 default SELinux configuration should be
-sufficiently reasonable that most systems will boot without serious
-problems. Some applications that require deep or unusual system
-privileges, such as virtual machine software, may not be compatible
-with SELinux in its default configuration. However, this should be
-uncommon, and SELinux's application support continues to improve.
-In other cases, SELinux may reveal unusual or insecure program
-behavior by design.
-<br /><br />
-The directive <tt>SELINUXTYPE=targeted</tt> configures SELinux to use
-the default targeted policy.
-<br /><br />
-The SELinux boot mode specified in <tt>/etc/selinux/config</tt> can be
-overridden by command-line arguments passed to the kernel. It is
-necessary to check <tt>grub.conf</tt> to ensure that this has not been done
-and to protect the boot process.
-</description>
 
 <Value id="var_selinux_state_name" type="string" operator="equals" interactive="0">
 <title>SELinux state</title>
@@ -82,7 +42,7 @@ and to protect the boot process.
 </Value>
 
 <Rule id="enable_selinux_bootloader">
-<title>Ensure SELinux Not Disabled in /etc/grub.conf</title>
+<title>Ensure SELinux Not Disabled at Boot</title>
 <description>SELinux can be disabled at boot time by an argument
 in <tt>/etc/grub.conf</tt>.
 To ensure that SELinux is not disabled at boot time, ensure that <tt>selinux=0</tt> is not
@@ -99,15 +59,21 @@ the chances that it remain off during system operation.
 </Rule>
 
 <Rule id="set_selinux_state">
-<title>Check SELinux State</title>
+<title>Ensure SELinux in Enforcing Mode</title>
 <description>The SELinux state should be set to <tt>enforcing</tt> during
 normal system operation. To ensure the system is configured to
 boot into enforcing mode, add or correct the following line in
 <tt>/etc/selinux/config</tt>:
 <pre>SELINUX=enforcing</pre>
+If SELinux is suspected of involvement with boot-time problems
+(unlikely), it is possible to boot into the warning-only mode
+<tt>SELINUX=permissive</tt> for debugging purposes. Make certain to change
+the mode back to enforcing after debugging, set the filesystems to
+be relabelled for consistency using the command <tt>touch
+/.autorelabel</tt>, and reboot.
 </description>
 <rationale>
-Setting the SELinux state to enforcing ensures that SELinux is able to confine
+Setting the SELinux state to <tt>enforcing</tt> ensures that SELinux is able to confine
 potentially compromised processes to the security policy, which is designed to
 prevent them from causing damage to the system or further elevating their
 privileges.
@@ -118,7 +84,7 @@ privileges.
 </Rule>
 
 <Rule id="set_selinux_policy">
-<title>Check SELinux Policy</title>
+<title>Ensure SELinux Policy Selected</title>
 <description>The SELinux <tt>targeted</tt> policy is appropriate for
 general-purpose desktops and servers, as well as systems in many other roles.
 To configure the system to use this policy,
@@ -137,7 +103,6 @@ targeted for exploitation, such as network services or system services.
 <oval id="selinux_policytype" value="var_selinux_policy_name"/>
 <ref nist="CM-6, CM-7" />
 </Rule>
-</Group>
 
 
 <Rule id="service_restorecond_enabled">
@@ -159,43 +124,6 @@ of file contexts created by some programs.</rationale>
 </Rule>
 
 
-<!--
-<Group id="selinux_daemons">
-<title>Disable Unnecessary SELinux Daemons</title>
-<description>Several daemons are installed by default as part of
-the RHEL6 SELinux support mechanism. These daemons may improve the
-system's ability to enforce SELinux policy in a useful fashion, but
-may also represent unnecessary code running on the machine,
-increasing system risk. If these daemons are not needed on your
-system, they should be disabled.</description>
-<Group id="group-2.4.3.2">
-<title>Disable MCS Translation Service (mcstrans) if
-Possible</title>
-<description>Unless there is some overriding need for the
-convenience of category label translation, disable the MCS
-translation service:
-<pre># chkconfig mcstrans off</pre>
-The mcstransd daemon provides the category label translation
-information defined in <tt>/etc/selinux/targeted/setrans.conf</tt> to
-client processes which request this information.
-<br /><br />
-Category labelling is unlikely to be used except in sites
-with special requirements. Therefore, it should be disabled in
-order to reduce the amount of potentially vulnerable code running
-on the system. See Section 2.4.6 for more information about systems
-which use category labelling.</description>
-
-<Rule id="disable_mcstransd">
-<title>Disable mcstrans Service</title>
-<description>The MCS Translation Service (mcstrans) should be disabled.</description>
-<ident cce="3668-1" />
-<oval id="service_mcstrans_disabled" />
-<ref nist="CM-6, CM-7" />
-</Rule>
-</Group>
-</Group>
--->
-
 <Rule id="selinux_confinement_of_daemons">
 <title>Ensure No Daemons are Unconfined by SELinux</title>
 <description>
@@ -222,7 +150,7 @@ Device files are used for communication with important
 system resources. SELinux contexts should exist for these.
 <br /><br />
 To check for unlabeled device files, run the following command:
-<pre># ls -Z | grep unlabeled_t</pre>
+<pre># ls -RZ /dev | grep unlabeled_t</pre>
 It should produce no output in a well-configured system.
 </description>
 <rationale>
-- 
1.7.1



More information about the scap-security-guide mailing list