[PATCH 11/11] Updated OVAL + remediation for selinux_state

Shawn Wells shawn at redhat.com
Tue Nov 12 16:33:16 UTC 2013


-------------- next part --------------
>From ba1d017dfd46d426d750bd112ab2aa74a15e0e28 Mon Sep 17 00:00:00 2001
From: Shawn Wells <shawn at redhat.com>
Date: Sun, 10 Nov 2013 03:03:30 -0500
Subject: [PATCH 11/11] Updated OVAL + remediation for selinux_state
 - Naming scheme updates (selinux_mode->selinux_state, variable to var_selinux_state)
 - Filename->filepath
 - Remediation script

TESTING
[root at SSG-RHEL6 checks]# grep SELINUX= /etc/selinux/config
[root at SSG-RHEL6 checks]# ./testcheck.py selinux_state.xml
external_variable with id : var_selinux_state
Evaluating with OVAL tempfile : /tmp/selinux_state6YAzZT.xml
Writing results to : /tmp/selinux_state6YAzZT.xml-results
Definition oval:scap-security-guide.testing:def:302: false
Evaluation done.
[root at SSG-RHEL6 checks]# cd ../fixes/bash/
[root at SSG-RHEL6 bash]# bash selinux_state.sh
[root at SSG-RHEL6 bash]# cd -
/var/www/html/scap-security-guide/RHEL6/input/checks
[root at SSG-RHEL6 checks]# ./testcheck.py selinux_state.xml
external_variable with id : var_selinux_state
Evaluating with OVAL tempfile : /tmp/selinux_state3ML5ZK.xml
Writing results to : /tmp/selinux_state3ML5ZK.xml-results
Definition oval:scap-security-guide.testing:def:302: true
Evaluation done.
---
 RHEL6/input/auxiliary/stig_overlay.xml             |    2 +-
 RHEL6/input/checks/selinux_mode.xml                |   35 --------------------
 RHEL6/input/checks/selinux_state.xml               |   35 ++++++++++++++++++++
 RHEL6/input/fixes/bash/selinux_state.sh            |    8 ++++
 RHEL6/input/profiles/CS2.xml                       |    2 +-
 RHEL6/input/profiles/common.xml                    |    4 +-
 RHEL6/input/profiles/fisma-medium-rhel6-server.xml |    2 +-
 RHEL6/input/profiles/nist-CL-IL-AL.xml             |    4 +-
 RHEL6/input/profiles/rht-ccp.xml                   |    4 +-
 RHEL6/input/profiles/test.xml                      |    4 +-
 RHEL6/input/profiles/usgcb-rhel6-server.xml        |    4 +-
 RHEL6/input/system/selinux.xml                     |    6 ++--
 12 files changed, 59 insertions(+), 51 deletions(-)
 delete mode 100644 RHEL6/input/checks/selinux_mode.xml
 create mode 100644 RHEL6/input/checks/selinux_state.xml
 create mode 100644 RHEL6/input/fixes/bash/selinux_state.sh

diff --git a/RHEL6/input/auxiliary/stig_overlay.xml b/RHEL6/input/auxiliary/stig_overlay.xml
index 4514436..1d546fb 100644
--- a/RHEL6/input/auxiliary/stig_overlay.xml
+++ b/RHEL6/input/auxiliary/stig_overlay.xml
@@ -42,7 +42,7 @@
 	<overlay owner="disastig" ruleid="no_rsh_trust_files" ownerid="RHEL-06-000019" disa="1436" severity="high">
 		<title>There must be no .rhosts or hosts.equiv files on the system.</title>
 	</overlay>
-	<overlay owner="disastig" ruleid="set_selinux_state" ownerid="RHEL-06-000020" disa="22" severity="medium">
+	<overlay owner="disastig" ruleid="selinux_state" ownerid="RHEL-06-000020" disa="22" severity="medium">
 		<title>The system must use a Linux Security Module configured to enforce limits on system services.</title>
 	</overlay>
 	<overlay owner="disastig" ruleid="selinux_policytype" ownerid="RHEL-06-000023" disa="22" severity="low">
diff --git a/RHEL6/input/checks/selinux_mode.xml b/RHEL6/input/checks/selinux_mode.xml
deleted file mode 100644
index affd4ca..0000000
--- a/RHEL6/input/checks/selinux_mode.xml
+++ /dev/null
@@ -1,35 +0,0 @@
-<def-group>
-  <definition class="compliance" id="selinux_mode" version="1">
-    <metadata>
-      <title>SELinux Enforcing</title>
-      <affected family="unix">
-        <platform>Red Hat Enterprise Linux 6</platform>
-      </affected>
-      <description>The SELinux state should be enforcing the local policy.</description>
-      <reference source="MED" ref_id="20130819" ref_url="test_attestation" />
-    </metadata>
-    <criteria operator="AND">
-      <criterion comment="enforce is disabled" test_ref="test_etc_selinux_config" />
-    </criteria>
-  </definition>
-
-  <ind:textfilecontent54_test check="all" check_existence="all_exist"
-  comment="/selinux/enforce is 1" id="test_etc_selinux_config" version="1">
-    <ind:object object_ref="object_etc_selinux_config" />
-    <ind:state state_ref="state_etc_selinux_config" />
-  </ind:textfilecontent54_test>
-
-  <ind:textfilecontent54_object id="object_etc_selinux_config" version="1">
-    <ind:path>/etc/selinux</ind:path>
-    <ind:filename>config</ind:filename>
-    <ind:pattern operation="pattern match">^[\s]*SELINUX[\s]*=[\s]*(.*)[\s]*$</ind:pattern>
-    <ind:instance datatype="int">1</ind:instance>
-  </ind:textfilecontent54_object>
-
-  <ind:textfilecontent54_state id="state_etc_selinux_config" version="1">
-    <ind:subexpression datatype="string" operation="equals" var_check="all" var_ref="var_selinux_state_name" />
-  </ind:textfilecontent54_state>
-
-  <external_variable comment="external variable for selinux state"
-  datatype="string" id="var_selinux_state_name" version="1" />
-</def-group>
diff --git a/RHEL6/input/checks/selinux_state.xml b/RHEL6/input/checks/selinux_state.xml
new file mode 100644
index 0000000..4ba9018
--- /dev/null
+++ b/RHEL6/input/checks/selinux_state.xml
@@ -0,0 +1,35 @@
+<def-group>
+  <definition class="compliance" id="selinux_state" version="1">
+    <metadata>
+      <title>SELinux Enforcing</title>
+      <affected family="unix">
+        <platform>Red Hat Enterprise Linux 6</platform>
+      </affected>
+      <description>The SELinux state should be enforcing the local policy.</description>
+      <reference source="MED" ref_id="20130819" ref_url="test_attestation" />
+    </metadata>
+    <criteria operator="AND">
+      <criterion comment="enforce is disabled" test_ref="test_etc_selinux_config" />
+    </criteria>
+  </definition>
+
+  <ind:textfilecontent54_test check="all" check_existence="all_exist"
+  comment="/selinux/enforce is 1" id="test_etc_selinux_config" version="1">
+    <ind:object object_ref="object_etc_selinux_config" />
+    <ind:state state_ref="state_etc_selinux_config" />
+  </ind:textfilecontent54_test>
+
+  <ind:textfilecontent54_object id="object_etc_selinux_config" version="1">
+    <ind:path>/etc/selinux</ind:path>
+    <ind:filename>config</ind:filename>
+    <ind:pattern operation="pattern match">^[\s]*SELINUX[\s]*=[\s]*(.*)[\s]*$</ind:pattern>
+    <ind:instance datatype="int">1</ind:instance>
+  </ind:textfilecontent54_object>
+
+  <ind:textfilecontent54_state id="state_etc_selinux_config" version="1">
+    <ind:subexpression datatype="string" operation="equals" var_check="all" var_ref="var_selinux_state" />
+  </ind:textfilecontent54_state>
+
+  <external_variable comment="external variable for selinux state"
+  datatype="string" id="var_selinux_state" version="1" />
+</def-group>
diff --git a/RHEL6/input/fixes/bash/selinux_state.sh b/RHEL6/input/fixes/bash/selinux_state.sh
new file mode 100644
index 0000000..c7d39ac
--- /dev/null
+++ b/RHEL6/input/fixes/bash/selinux_state.sh
@@ -0,0 +1,8 @@
+source ./templates/support.sh
+populate var_selinux_state
+
+grep -q ^SELINUX= /etc/selinux/config && \
+  sed -i "s/SELINUX=.*/SELINUX=$var_selinux_state/g" /etc/selinux/config
+if ! [ $? -eq 0 ]; then
+    echo "SELINUX=$var_selinux_state" >> /etc/selinux/config
+fi
diff --git a/RHEL6/input/profiles/CS2.xml b/RHEL6/input/profiles/CS2.xml
index 32ebb66..f1cc155 100644
--- a/RHEL6/input/profiles/CS2.xml
+++ b/RHEL6/input/profiles/CS2.xml
@@ -175,7 +175,7 @@
 
 <select idref="selinux_confinement_of_daemons" selected="true" />
 <select idref="selinux_all_devicefiles_labeled" selected="true"/>
-<select idref="set_selinux_state" selected="true"/>
+<select idref="selinux_state" selected="true"/>
 <select idref="selinux_policytype" selected="true"/>
 
 <select idref="require_singleuser_auth" selected="true"/>
diff --git a/RHEL6/input/profiles/common.xml b/RHEL6/input/profiles/common.xml
index f87d3ec..4134266 100644
--- a/RHEL6/input/profiles/common.xml
+++ b/RHEL6/input/profiles/common.xml
@@ -14,7 +14,7 @@
 <select idref="package_aide_installed" selected="true"/>
 <select idref="enable_selinux_bootloader" selected="true"/>
 <select idref="no_rsh_trust_files" selected="true"/>
-<select idref="set_selinux_state" selected="true"/>
+<select idref="selinux_state" selected="true"/>
 <select idref="selinux_policytype" selected="true"/>
 <select idref="selinux_all_devicefiles_labeled" selected="true"/>
 <select idref="securetty_root_login_console_only" selected="true"/>
@@ -258,7 +258,7 @@ these should likely be moved out of common.
 <!-- Sensible umask -->
 <refine-value idref="login_banner_text" selector="usgcb_default"/>
 <!-- login banner verbiage -->
-<refine-value idref="var_selinux_state_name" selector="enforcing"/>
+<refine-value idref="var_selinux_state" selector="enforcing"/>
 <!-- SELinux state -->
 <refine-value idref="var_selinux_policy_name" selector="targeted"/>
 <!-- SELinux policy -->
diff --git a/RHEL6/input/profiles/fisma-medium-rhel6-server.xml b/RHEL6/input/profiles/fisma-medium-rhel6-server.xml
index 7e28b68..00d85e8 100644
--- a/RHEL6/input/profiles/fisma-medium-rhel6-server.xml
+++ b/RHEL6/input/profiles/fisma-medium-rhel6-server.xml
@@ -17,7 +17,7 @@
 
 <!--	AC-3, AC-3(3) -->
 <select idref="enable_selinux_bootloader" selected="true" />
-<select idref="set_selinux_state" selected="true" />
+<select idref="selinux_state" selected="true" />
 <select idref="selinux_policytype" selected="true" />
 <select idref="service_restorecond_enabled" selected="true" />
 <select idref="sshd_use_approved_ciphers" selected="true" />
diff --git a/RHEL6/input/profiles/nist-CL-IL-AL.xml b/RHEL6/input/profiles/nist-CL-IL-AL.xml
index a02b714..5e9be13 100644
--- a/RHEL6/input/profiles/nist-CL-IL-AL.xml
+++ b/RHEL6/input/profiles/nist-CL-IL-AL.xml
@@ -22,7 +22,7 @@ assurance."</description>
 
 	To meet this, SELinux *must* be enabled and configured against either
 	"targeted" or "mls" mode -->
-<refine-value idref="var_selinux_state_name" selector="enforcing" \>
+<refine-value idref="var_selinux_state" selector="enforcing" \>
 <refine-value idref="var_selinux_policy_name" selector="targeted" \>
 
 <!--	AC-4:	TBD 
@@ -111,7 +111,7 @@ assurance."</description>
 <!--  AC-3 -->
 <select idref="sshd_use_approved_ciphers" selected="true" \>
 <select idref="enable_selinux_bootloader" selected="true" \>
-<select idref="set_selinux_state" selected="true" \>
+<select idref="selinux_state" selected="true" \>
 <select idref="selinux_policytype" selected="true" \>
 <select idref="service_restorecond_enabled" selected="true" \>
 
diff --git a/RHEL6/input/profiles/rht-ccp.xml b/RHEL6/input/profiles/rht-ccp.xml
index ca72dd7..5d0cd48 100644
--- a/RHEL6/input/profiles/rht-ccp.xml
+++ b/RHEL6/input/profiles/rht-ccp.xml
@@ -2,7 +2,7 @@
 <title>Red Hat Corporate Profile for Certified Cloud Providers (RH CCP)</title>
 <description>This is a *draft* SCAP profile for Red Hat Certified Cloud Providers</description>
 <!-- CONFIGURATION OPTIONS -->
-<refine-value idref="var_selinux_state_name" selector="enforcing"/>
+<refine-value idref="var_selinux_state" selector="enforcing"/>
 <refine-value idref="var_selinux_policy_name" selector="targeted"/>
 <refine-value idref="file_owner_logfiles_value" selector="root"/>
 <refine-value idref="file_groupowner_logfiles_value" selector="root"/>
@@ -30,7 +30,7 @@
 
 <!-- SELINUX CHECKS -->
 <select idref="enable_selinux_bootloader" selected="true"/>
-<select idref="set_selinux_state" selected="true"/>
+<select idref="selinux_state" selected="true"/>
 <select idref="selinux_policytype" selected="true"/>
 <select idref="selinux_all_devicefiles_labeled" selected="true"/>
 
diff --git a/RHEL6/input/profiles/test.xml b/RHEL6/input/profiles/test.xml
index 758d8bf..c7ddfd7 100644
--- a/RHEL6/input/profiles/test.xml
+++ b/RHEL6/input/profiles/test.xml
@@ -9,7 +9,7 @@
 <select idref="package_rsyslog_installed" selected="true"/>
 <select idref="service_rsyslog_enabled" selected="true"/>
 <select idref="disable_vsftpd" selected="true"/>
-<select idref="set_selinux_state" selected="true"/>
+<select idref="selinux_state" selected="true"/>
 <select idref="accounts_password_pam_cracklib_dcredit" selected="true"/>
 <select idref="tftpd_uses_secure_mode" selected="true"/>
 <select idref="set_system_login_banner" selected="true"/>
@@ -22,7 +22,7 @@
 <select idref="packagegroup_xwindows_remove" selected="true"/>
 <refine-value idref="login_banner_text" selector="usgcb_default"/>
 <refine-value idref="var_umask_for_daemons" selector="027"/>
-<refine-value idref="var_selinux_state_name" selector="enforcing"/>
+<refine-value idref="var_selinux_state" selector="enforcing"/>
 <refine-value idref="var_password_pam_cracklib_dcredit" selector="1"/>
 <refine-value idref="inactivity_timeout_value" selector="10_minutes"/>
 -->
diff --git a/RHEL6/input/profiles/usgcb-rhel6-server.xml b/RHEL6/input/profiles/usgcb-rhel6-server.xml
index 6eab024..5fcee18 100644
--- a/RHEL6/input/profiles/usgcb-rhel6-server.xml
+++ b/RHEL6/input/profiles/usgcb-rhel6-server.xml
@@ -108,8 +108,8 @@
 <select idref="set_blank_screensaver" selected="true" />
 <refine-value idref="login_banner_text" selector="usgcb_default" />
 <select idref="set_system_login_banner" selected="true" />
-<refine-value idref="var_selinux_state_name" selector="enforcing" />
-<select idref="set_selinux_state" selected="true" />
+<refine-value idref="var_selinux_state" selector="enforcing" />
+<select idref="selinux_state" selected="true" />
 <refine-value idref="var_selinux_policy_name" selector="targeted" />
 <select idref="selinux_policytype" selected="true" />
 <select idref="enable_selinux_bootloader" selected="true" />
diff --git a/RHEL6/input/system/selinux.xml b/RHEL6/input/system/selinux.xml
index 80f4fc0..3b6b338 100644
--- a/RHEL6/input/system/selinux.xml
+++ b/RHEL6/input/system/selinux.xml
@@ -58,7 +58,7 @@ necessary to check <tt>grub.conf</tt> to ensure that this has not been done
 and to protect the boot process.
 </description>
 
-<Value id="var_selinux_state_name" type="string" operator="equals" interactive="0">
+<Value id="var_selinux_state" type="string" operator="equals" interactive="0">
 <title>SELinux state</title>
 <description>enforcing - SELinux security policy is enforced.
 <br />permissive - SELinux prints warnings instead of enforcing.
@@ -103,7 +103,7 @@ the chances that it will remain off during system operation.
 <tested by="DS" on="20121024"/>
 </Rule>
 
-<Rule id="set_selinux_state" severity="medium">
+<Rule id="selinux_state" severity="medium">
 <title>Ensure SELinux State is Enforcing</title>
 <description>The SELinux state should be set to <tt>enforcing</tt> at
 system boot time.  In the file <tt>/etc/selinux/config</tt>, add or correct the
@@ -121,7 +121,7 @@ prevent them from causing damage to the system or further elevating their
 privileges.
 </rationale>
 <ident cce="26969-6" />
-<oval id="selinux_mode" value="var_selinux_state_name"/>
+<oval id="selinux_state" value="var_selinux_state"/>
 <ref nist="AC-3,AC-3(3),AC-4,AC-6,AU-9" disa="22,32,26"/>
 <tested by="DS" on="20121024"/>
 </Rule>
-- 
1.7.1



More information about the scap-security-guide mailing list