[PATCH] prose cleanup of SELinux discussion

Shawn Wells swells at redhat.com
Mon Jun 11 22:19:08 UTC 2012



On Jun 11, 2012, at 6:13 PM, Jeffrey Blank <blank at eclipse.ncsc.mil> wrote:

> 
> Signed-off-by: Jeffrey Blank <blank at eclipse.ncsc.mil>
> ---
> rhel6/src/input/system/selinux.xml |  116 +++++++-----------------------------
> 1 files changed, 22 insertions(+), 94 deletions(-)
> 
> diff --git a/rhel6/src/input/system/selinux.xml b/rhel6/src/input/system/selinux.xml
> index 803cdf9..72e8a7d 100644
> --- a/rhel6/src/input/system/selinux.xml
> +++ b/rhel6/src/input/system/selinux.xml
> @@ -3,60 +3,20 @@
> <description>SELinux is a feature of the Linux kernel which can be
> used to guard against misconfigured or compromised programs.
> SELinux enforces the idea that programs should be limited in what
> -files they can access and what actions they can take.
> +resources they can access and what actions they can take.
> <br /><br />
> -The default SELinux policy, as configured on RHEL6, has been
> -sufficiently developed and debugged that it should be usable on
> -almost any Red Hat machine with minimal configuration and a small
> -amount of system administrator training. This policy prevents
> -system services — including most of the common network-visible
> -services such as mail servers, ftp servers, and DNS servers — from
> -accessing files which those services have no valid reason to
> -access. This action alone prevents a huge amount of possible damage
> -from network attacks against services, from trojaned software, and
> -so forth.
> -<br /><br />
> -This guide recommends that SELinux be enabled using the
> -default (targeted) policy on every Red Hat system, unless that
> -system has requirements which make a stronger policy
> -appropriate.
> +Support for SELinux is provided out-of-the-box on RHEL. The default SELinux
> +policy included with RHEL, called <tt>targeted</tt>, should be usable with
> +minimal configuration and a small amount of system administrator training. This
> +policy prevents system services — including most of the common network-visible
> +services such as mail servers, ftp servers, and DNS servers — from accessing
> +files which those services have no valid reason to access. This action alone
> +can prevent serious damage from attacks which may compromise system services.
> +Creation and deployment of custom SELinux policies can allow satisfaction of
> +even stronger security goals, though this is generally done for systems that
> +fill specialized, security-critical roles instead of general purpose systems.
> </description>
> 
> -<Group id="enabling_selinux">
> -<title>Enable SELinux</title>
> -<description>Edit the file <tt>/etc/selinux/config</tt>. Add or correct the
> -following lines:
> -<pre>SELINUX=enforcing
> -SELINUXTYPE=targeted</pre>
> -Edit the file <tt>/etc/grub.conf</tt>. Ensure that the following
> -arguments DO NOT appear on any kernel command line in the file:
> -<pre>selinux=0
> -enforcing=0</pre>
> -The directive <tt>SELINUX=enforcing</tt> enables SELinux at boot time.
> -If SELinux is suspected of involvement with boot-time problems
> -(unlikely), it is possible to boot into the warning-only mode
> -<tt>SELINUX=permissive</tt> for debugging purposes. Make certain to change
> -the mode back to enforcing after debugging, set the filesystems to
> -be relabelled for consistency using the command <tt>touch
> -/.autorelabel</tt>, and reboot.
> -<br /><br />
> -However, the RHEL6 default SELinux configuration should be
> -sufficiently reasonable that most systems will boot without serious
> -problems. Some applications that require deep or unusual system
> -privileges, such as virtual machine software, may not be compatible
> -with SELinux in its default configuration. However, this should be
> -uncommon, and SELinux's application support continues to improve.
> -In other cases, SELinux may reveal unusual or insecure program
> -behavior by design.
> -<br /><br />
> -The directive <tt>SELINUXTYPE=targeted</tt> configures SELinux to use
> -the default targeted policy.
> -<br /><br />
> -The SELinux boot mode specified in <tt>/etc/selinux/config</tt> can be
> -overridden by command-line arguments passed to the kernel. It is
> -necessary to check <tt>grub.conf</tt> to ensure that this has not been done
> -and to protect the boot process.
> -</description>
> 
> <Value id="var_selinux_state_name" type="string" operator="equals" interactive="0">
> <title>SELinux state</title>
> @@ -82,7 +42,7 @@ and to protect the boot process.
> </Value>
> 
> <Rule id="enable_selinux_bootloader">
> -<title>Ensure SELinux Not Disabled in /etc/grub.conf</title>
> +<title>Ensure SELinux Not Disabled at Boot</title>
> <description>SELinux can be disabled at boot time by an argument
> in <tt>/etc/grub.conf</tt>.
> To ensure that SELinux is not disabled at boot time, ensure that <tt>selinux=0</tt> is not
> @@ -99,15 +59,21 @@ the chances that it remain off during system operation.
> </Rule>
> 
> <Rule id="set_selinux_state">
> -<title>Check SELinux State</title>
> +<title>Ensure SELinux in Enforcing Mode</title>
> <description>The SELinux state should be set to <tt>enforcing</tt> during
> normal system operation. To ensure the system is configured to
> boot into enforcing mode, add or correct the following line in
> <tt>/etc/selinux/config</tt>:
> <pre>SELINUX=enforcing</pre>
> +If SELinux is suspected of involvement with boot-time problems
> +(unlikely), it is possible to boot into the warning-only mode
> +<tt>SELINUX=permissive</tt> for debugging purposes. Make certain to change
> +the mode back to enforcing after debugging, set the filesystems to
> +be relabelled for consistency using the command <tt>touch
> +/.autorelabel</tt>, and reboot.
> </description>
> <rationale>
> -Setting the SELinux state to enforcing ensures that SELinux is able to confine
> +Setting the SELinux state to <tt>enforcing</tt> ensures that SELinux is able to confine
> potentially compromised processes to the security policy, which is designed to
> prevent them from causing damage to the system or further elevating their
> privileges.
> @@ -118,7 +84,7 @@ privileges.
> </Rule>
> 
> <Rule id="set_selinux_policy">
> -<title>Check SELinux Policy</title>
> +<title>Ensure SELinux Policy Selected</title>
> <description>The SELinux <tt>targeted</tt> policy is appropriate for
> general-purpose desktops and servers, as well as systems in many other roles.
> To configure the system to use this policy,
> @@ -137,7 +103,6 @@ targeted for exploitation, such as network services or system services.
> <oval id="selinux_policytype" value="var_selinux_policy_name"/>
> <ref nist="CM-6, CM-7" />
> </Rule>
> -</Group>
> 
> 
> <Rule id="service_restorecond_enabled">
> @@ -159,43 +124,6 @@ of file contexts created by some programs.</rationale>
> </Rule>
> 
> 
> -<!--
> -<Group id="selinux_daemons">
> -<title>Disable Unnecessary SELinux Daemons</title>
> -<description>Several daemons are installed by default as part of
> -the RHEL6 SELinux support mechanism. These daemons may improve the
> -system's ability to enforce SELinux policy in a useful fashion, but
> -may also represent unnecessary code running on the machine,
> -increasing system risk. If these daemons are not needed on your
> -system, they should be disabled.</description>
> -<Group id="group-2.4.3.2">
> -<title>Disable MCS Translation Service (mcstrans) if
> -Possible</title>
> -<description>Unless there is some overriding need for the
> -convenience of category label translation, disable the MCS
> -translation service:
> -<pre># chkconfig mcstrans off</pre>
> -The mcstransd daemon provides the category label translation
> -information defined in <tt>/etc/selinux/targeted/setrans.conf</tt> to
> -client processes which request this information.
> -<br /><br />
> -Category labelling is unlikely to be used except in sites
> -with special requirements. Therefore, it should be disabled in
> -order to reduce the amount of potentially vulnerable code running
> -on the system. See Section 2.4.6 for more information about systems
> -which use category labelling.</description>
> -
> -<Rule id="disable_mcstransd">
> -<title>Disable mcstrans Service</title>
> -<description>The MCS Translation Service (mcstrans) should be disabled.</description>
> -<ident cce="3668-1" />
> -<oval id="service_mcstrans_disabled" />
> -<ref nist="CM-6, CM-7" />
> -</Rule>
> -</Group>
> -</Group>
> --->
> -
> <Rule id="selinux_confinement_of_daemons">
> <title>Ensure No Daemons are Unconfined by SELinux</title>
> <description>
> @@ -222,7 +150,7 @@ Device files are used for communication with important
> system resources. SELinux contexts should exist for these.
> <br /><br />
> To check for unlabeled device files, run the following command:
> -<pre># ls -Z | grep unlabeled_t</pre>
> +<pre># ls -RZ /dev | grep unlabeled_t</pre>
> It should produce no output in a well-configured system.
> </description>
> <rationale>
> -- 
> 1.7.1


Ack


> 
> _______________________________________________
> scap-security-guide mailing list
> scap-security-guide at lists.fedorahosted.org
> https://fedorahosted.org/mailman/listinfo/scap-security-guide


More information about the scap-security-guide mailing list