[PATCH 2/3] corrected severity listing for SELinux
Shawn Wells
shawn at redhat.com
Wed Oct 31 19:23:15 UTC 2012
On 10/31/12 1:46 PM, David Smith wrote:
> Signed-off-by: David Smith <dsmith at eclipse.ncsc.mil>
> ---
> RHEL6/input/system/selinux.xml | 4 ++--
> 1 files changed, 2 insertions(+), 2 deletions(-)
>
> diff --git a/RHEL6/input/system/selinux.xml b/RHEL6/input/system/selinux.xml
> index 54c66f5..7a88b58 100644
> --- a/RHEL6/input/system/selinux.xml
> +++ b/RHEL6/input/system/selinux.xml
> @@ -82,7 +82,7 @@ and to protect the boot process.
> <value selector="mls">mls</value>
> </Value>
>
> -<Rule id="enable_selinux_bootloader" severity="high">
> +<Rule id="enable_selinux_bootloader" severity="medium">
> <title>Ensure SELinux Not Disabled in /etc/grub.conf</title>
> <description>SELinux can be disabled at boot time by an argument in
> <tt>/etc/grub.conf</tt>.
> @@ -146,7 +146,7 @@ Check the file <tt>/etc/selinux/config</tt> and ensure the following line appear
> <rationale>
> Setting the SELinux policy to <tt>targeted</tt> or a more specialized policy
> ensures that the system will confine processes that are likely to be
> -targeted for exploitation, such as network services or system services.
> +targeted for exploitation, such as network or system services.
> </rationale>
> <ident cce="3624-4" />
> <oval id="selinux_policytype" value="var_selinux_policy_name"/>
Good catch. Forgot SELinux was called out in multiple places.
Ack
More information about the scap-security-guide
mailing list