[PATCH 11/11] Updated OVAL + remediation for selinux_state
Shawn Wells
shawn at redhat.com
Tue Nov 12 16:33:16 UTC 2013
-------------- next part --------------
>From ba1d017dfd46d426d750bd112ab2aa74a15e0e28 Mon Sep 17 00:00:00 2001
From: Shawn Wells <shawn at redhat.com>
Date: Sun, 10 Nov 2013 03:03:30 -0500
Subject: [PATCH 11/11] Updated OVAL + remediation for selinux_state
- Naming scheme updates (selinux_mode->selinux_state, variable to var_selinux_state)
- Filename->filepath
- Remediation script
TESTING
[root at SSG-RHEL6 checks]# grep SELINUX= /etc/selinux/config
[root at SSG-RHEL6 checks]# ./testcheck.py selinux_state.xml
external_variable with id : var_selinux_state
Evaluating with OVAL tempfile : /tmp/selinux_state6YAzZT.xml
Writing results to : /tmp/selinux_state6YAzZT.xml-results
Definition oval:scap-security-guide.testing:def:302: false
Evaluation done.
[root at SSG-RHEL6 checks]# cd ../fixes/bash/
[root at SSG-RHEL6 bash]# bash selinux_state.sh
[root at SSG-RHEL6 bash]# cd -
/var/www/html/scap-security-guide/RHEL6/input/checks
[root at SSG-RHEL6 checks]# ./testcheck.py selinux_state.xml
external_variable with id : var_selinux_state
Evaluating with OVAL tempfile : /tmp/selinux_state3ML5ZK.xml
Writing results to : /tmp/selinux_state3ML5ZK.xml-results
Definition oval:scap-security-guide.testing:def:302: true
Evaluation done.
---
RHEL6/input/auxiliary/stig_overlay.xml | 2 +-
RHEL6/input/checks/selinux_mode.xml | 35 --------------------
RHEL6/input/checks/selinux_state.xml | 35 ++++++++++++++++++++
RHEL6/input/fixes/bash/selinux_state.sh | 8 ++++
RHEL6/input/profiles/CS2.xml | 2 +-
RHEL6/input/profiles/common.xml | 4 +-
RHEL6/input/profiles/fisma-medium-rhel6-server.xml | 2 +-
RHEL6/input/profiles/nist-CL-IL-AL.xml | 4 +-
RHEL6/input/profiles/rht-ccp.xml | 4 +-
RHEL6/input/profiles/test.xml | 4 +-
RHEL6/input/profiles/usgcb-rhel6-server.xml | 4 +-
RHEL6/input/system/selinux.xml | 6 ++--
12 files changed, 59 insertions(+), 51 deletions(-)
delete mode 100644 RHEL6/input/checks/selinux_mode.xml
create mode 100644 RHEL6/input/checks/selinux_state.xml
create mode 100644 RHEL6/input/fixes/bash/selinux_state.sh
diff --git a/RHEL6/input/auxiliary/stig_overlay.xml b/RHEL6/input/auxiliary/stig_overlay.xml
index 4514436..1d546fb 100644
--- a/RHEL6/input/auxiliary/stig_overlay.xml
+++ b/RHEL6/input/auxiliary/stig_overlay.xml
@@ -42,7 +42,7 @@
<overlay owner="disastig" ruleid="no_rsh_trust_files" ownerid="RHEL-06-000019" disa="1436" severity="high">
<title>There must be no .rhosts or hosts.equiv files on the system.</title>
</overlay>
- <overlay owner="disastig" ruleid="set_selinux_state" ownerid="RHEL-06-000020" disa="22" severity="medium">
+ <overlay owner="disastig" ruleid="selinux_state" ownerid="RHEL-06-000020" disa="22" severity="medium">
<title>The system must use a Linux Security Module configured to enforce limits on system services.</title>
</overlay>
<overlay owner="disastig" ruleid="selinux_policytype" ownerid="RHEL-06-000023" disa="22" severity="low">
diff --git a/RHEL6/input/checks/selinux_mode.xml b/RHEL6/input/checks/selinux_mode.xml
deleted file mode 100644
index affd4ca..0000000
--- a/RHEL6/input/checks/selinux_mode.xml
+++ /dev/null
@@ -1,35 +0,0 @@
-<def-group>
- <definition class="compliance" id="selinux_mode" version="1">
- <metadata>
- <title>SELinux Enforcing</title>
- <affected family="unix">
- <platform>Red Hat Enterprise Linux 6</platform>
- </affected>
- <description>The SELinux state should be enforcing the local policy.</description>
- <reference source="MED" ref_id="20130819" ref_url="test_attestation" />
- </metadata>
- <criteria operator="AND">
- <criterion comment="enforce is disabled" test_ref="test_etc_selinux_config" />
- </criteria>
- </definition>
-
- <ind:textfilecontent54_test check="all" check_existence="all_exist"
- comment="/selinux/enforce is 1" id="test_etc_selinux_config" version="1">
- <ind:object object_ref="object_etc_selinux_config" />
- <ind:state state_ref="state_etc_selinux_config" />
- </ind:textfilecontent54_test>
-
- <ind:textfilecontent54_object id="object_etc_selinux_config" version="1">
- <ind:path>/etc/selinux</ind:path>
- <ind:filename>config</ind:filename>
- <ind:pattern operation="pattern match">^[\s]*SELINUX[\s]*=[\s]*(.*)[\s]*$</ind:pattern>
- <ind:instance datatype="int">1</ind:instance>
- </ind:textfilecontent54_object>
-
- <ind:textfilecontent54_state id="state_etc_selinux_config" version="1">
- <ind:subexpression datatype="string" operation="equals" var_check="all" var_ref="var_selinux_state_name" />
- </ind:textfilecontent54_state>
-
- <external_variable comment="external variable for selinux state"
- datatype="string" id="var_selinux_state_name" version="1" />
-</def-group>
diff --git a/RHEL6/input/checks/selinux_state.xml b/RHEL6/input/checks/selinux_state.xml
new file mode 100644
index 0000000..4ba9018
--- /dev/null
+++ b/RHEL6/input/checks/selinux_state.xml
@@ -0,0 +1,35 @@
+<def-group>
+ <definition class="compliance" id="selinux_state" version="1">
+ <metadata>
+ <title>SELinux Enforcing</title>
+ <affected family="unix">
+ <platform>Red Hat Enterprise Linux 6</platform>
+ </affected>
+ <description>The SELinux state should be enforcing the local policy.</description>
+ <reference source="MED" ref_id="20130819" ref_url="test_attestation" />
+ </metadata>
+ <criteria operator="AND">
+ <criterion comment="enforce is disabled" test_ref="test_etc_selinux_config" />
+ </criteria>
+ </definition>
+
+ <ind:textfilecontent54_test check="all" check_existence="all_exist"
+ comment="/selinux/enforce is 1" id="test_etc_selinux_config" version="1">
+ <ind:object object_ref="object_etc_selinux_config" />
+ <ind:state state_ref="state_etc_selinux_config" />
+ </ind:textfilecontent54_test>
+
+ <ind:textfilecontent54_object id="object_etc_selinux_config" version="1">
+ <ind:path>/etc/selinux</ind:path>
+ <ind:filename>config</ind:filename>
+ <ind:pattern operation="pattern match">^[\s]*SELINUX[\s]*=[\s]*(.*)[\s]*$</ind:pattern>
+ <ind:instance datatype="int">1</ind:instance>
+ </ind:textfilecontent54_object>
+
+ <ind:textfilecontent54_state id="state_etc_selinux_config" version="1">
+ <ind:subexpression datatype="string" operation="equals" var_check="all" var_ref="var_selinux_state" />
+ </ind:textfilecontent54_state>
+
+ <external_variable comment="external variable for selinux state"
+ datatype="string" id="var_selinux_state" version="1" />
+</def-group>
diff --git a/RHEL6/input/fixes/bash/selinux_state.sh b/RHEL6/input/fixes/bash/selinux_state.sh
new file mode 100644
index 0000000..c7d39ac
--- /dev/null
+++ b/RHEL6/input/fixes/bash/selinux_state.sh
@@ -0,0 +1,8 @@
+source ./templates/support.sh
+populate var_selinux_state
+
+grep -q ^SELINUX= /etc/selinux/config && \
+ sed -i "s/SELINUX=.*/SELINUX=$var_selinux_state/g" /etc/selinux/config
+if ! [ $? -eq 0 ]; then
+ echo "SELINUX=$var_selinux_state" >> /etc/selinux/config
+fi
diff --git a/RHEL6/input/profiles/CS2.xml b/RHEL6/input/profiles/CS2.xml
index 32ebb66..f1cc155 100644
--- a/RHEL6/input/profiles/CS2.xml
+++ b/RHEL6/input/profiles/CS2.xml
@@ -175,7 +175,7 @@
<select idref="selinux_confinement_of_daemons" selected="true" />
<select idref="selinux_all_devicefiles_labeled" selected="true"/>
-<select idref="set_selinux_state" selected="true"/>
+<select idref="selinux_state" selected="true"/>
<select idref="selinux_policytype" selected="true"/>
<select idref="require_singleuser_auth" selected="true"/>
diff --git a/RHEL6/input/profiles/common.xml b/RHEL6/input/profiles/common.xml
index f87d3ec..4134266 100644
--- a/RHEL6/input/profiles/common.xml
+++ b/RHEL6/input/profiles/common.xml
@@ -14,7 +14,7 @@
<select idref="package_aide_installed" selected="true"/>
<select idref="enable_selinux_bootloader" selected="true"/>
<select idref="no_rsh_trust_files" selected="true"/>
-<select idref="set_selinux_state" selected="true"/>
+<select idref="selinux_state" selected="true"/>
<select idref="selinux_policytype" selected="true"/>
<select idref="selinux_all_devicefiles_labeled" selected="true"/>
<select idref="securetty_root_login_console_only" selected="true"/>
@@ -258,7 +258,7 @@ these should likely be moved out of common.
<!-- Sensible umask -->
<refine-value idref="login_banner_text" selector="usgcb_default"/>
<!-- login banner verbiage -->
-<refine-value idref="var_selinux_state_name" selector="enforcing"/>
+<refine-value idref="var_selinux_state" selector="enforcing"/>
<!-- SELinux state -->
<refine-value idref="var_selinux_policy_name" selector="targeted"/>
<!-- SELinux policy -->
diff --git a/RHEL6/input/profiles/fisma-medium-rhel6-server.xml b/RHEL6/input/profiles/fisma-medium-rhel6-server.xml
index 7e28b68..00d85e8 100644
--- a/RHEL6/input/profiles/fisma-medium-rhel6-server.xml
+++ b/RHEL6/input/profiles/fisma-medium-rhel6-server.xml
@@ -17,7 +17,7 @@
<!-- AC-3, AC-3(3) -->
<select idref="enable_selinux_bootloader" selected="true" />
-<select idref="set_selinux_state" selected="true" />
+<select idref="selinux_state" selected="true" />
<select idref="selinux_policytype" selected="true" />
<select idref="service_restorecond_enabled" selected="true" />
<select idref="sshd_use_approved_ciphers" selected="true" />
diff --git a/RHEL6/input/profiles/nist-CL-IL-AL.xml b/RHEL6/input/profiles/nist-CL-IL-AL.xml
index a02b714..5e9be13 100644
--- a/RHEL6/input/profiles/nist-CL-IL-AL.xml
+++ b/RHEL6/input/profiles/nist-CL-IL-AL.xml
@@ -22,7 +22,7 @@ assurance."</description>
To meet this, SELinux *must* be enabled and configured against either
"targeted" or "mls" mode -->
-<refine-value idref="var_selinux_state_name" selector="enforcing" \>
+<refine-value idref="var_selinux_state" selector="enforcing" \>
<refine-value idref="var_selinux_policy_name" selector="targeted" \>
<!-- AC-4: TBD
@@ -111,7 +111,7 @@ assurance."</description>
<!-- AC-3 -->
<select idref="sshd_use_approved_ciphers" selected="true" \>
<select idref="enable_selinux_bootloader" selected="true" \>
-<select idref="set_selinux_state" selected="true" \>
+<select idref="selinux_state" selected="true" \>
<select idref="selinux_policytype" selected="true" \>
<select idref="service_restorecond_enabled" selected="true" \>
diff --git a/RHEL6/input/profiles/rht-ccp.xml b/RHEL6/input/profiles/rht-ccp.xml
index ca72dd7..5d0cd48 100644
--- a/RHEL6/input/profiles/rht-ccp.xml
+++ b/RHEL6/input/profiles/rht-ccp.xml
@@ -2,7 +2,7 @@
<title>Red Hat Corporate Profile for Certified Cloud Providers (RH CCP)</title>
<description>This is a *draft* SCAP profile for Red Hat Certified Cloud Providers</description>
<!-- CONFIGURATION OPTIONS -->
-<refine-value idref="var_selinux_state_name" selector="enforcing"/>
+<refine-value idref="var_selinux_state" selector="enforcing"/>
<refine-value idref="var_selinux_policy_name" selector="targeted"/>
<refine-value idref="file_owner_logfiles_value" selector="root"/>
<refine-value idref="file_groupowner_logfiles_value" selector="root"/>
@@ -30,7 +30,7 @@
<!-- SELINUX CHECKS -->
<select idref="enable_selinux_bootloader" selected="true"/>
-<select idref="set_selinux_state" selected="true"/>
+<select idref="selinux_state" selected="true"/>
<select idref="selinux_policytype" selected="true"/>
<select idref="selinux_all_devicefiles_labeled" selected="true"/>
diff --git a/RHEL6/input/profiles/test.xml b/RHEL6/input/profiles/test.xml
index 758d8bf..c7ddfd7 100644
--- a/RHEL6/input/profiles/test.xml
+++ b/RHEL6/input/profiles/test.xml
@@ -9,7 +9,7 @@
<select idref="package_rsyslog_installed" selected="true"/>
<select idref="service_rsyslog_enabled" selected="true"/>
<select idref="disable_vsftpd" selected="true"/>
-<select idref="set_selinux_state" selected="true"/>
+<select idref="selinux_state" selected="true"/>
<select idref="accounts_password_pam_cracklib_dcredit" selected="true"/>
<select idref="tftpd_uses_secure_mode" selected="true"/>
<select idref="set_system_login_banner" selected="true"/>
@@ -22,7 +22,7 @@
<select idref="packagegroup_xwindows_remove" selected="true"/>
<refine-value idref="login_banner_text" selector="usgcb_default"/>
<refine-value idref="var_umask_for_daemons" selector="027"/>
-<refine-value idref="var_selinux_state_name" selector="enforcing"/>
+<refine-value idref="var_selinux_state" selector="enforcing"/>
<refine-value idref="var_password_pam_cracklib_dcredit" selector="1"/>
<refine-value idref="inactivity_timeout_value" selector="10_minutes"/>
-->
diff --git a/RHEL6/input/profiles/usgcb-rhel6-server.xml b/RHEL6/input/profiles/usgcb-rhel6-server.xml
index 6eab024..5fcee18 100644
--- a/RHEL6/input/profiles/usgcb-rhel6-server.xml
+++ b/RHEL6/input/profiles/usgcb-rhel6-server.xml
@@ -108,8 +108,8 @@
<select idref="set_blank_screensaver" selected="true" />
<refine-value idref="login_banner_text" selector="usgcb_default" />
<select idref="set_system_login_banner" selected="true" />
-<refine-value idref="var_selinux_state_name" selector="enforcing" />
-<select idref="set_selinux_state" selected="true" />
+<refine-value idref="var_selinux_state" selector="enforcing" />
+<select idref="selinux_state" selected="true" />
<refine-value idref="var_selinux_policy_name" selector="targeted" />
<select idref="selinux_policytype" selected="true" />
<select idref="enable_selinux_bootloader" selected="true" />
diff --git a/RHEL6/input/system/selinux.xml b/RHEL6/input/system/selinux.xml
index 80f4fc0..3b6b338 100644
--- a/RHEL6/input/system/selinux.xml
+++ b/RHEL6/input/system/selinux.xml
@@ -58,7 +58,7 @@ necessary to check <tt>grub.conf</tt> to ensure that this has not been done
and to protect the boot process.
</description>
-<Value id="var_selinux_state_name" type="string" operator="equals" interactive="0">
+<Value id="var_selinux_state" type="string" operator="equals" interactive="0">
<title>SELinux state</title>
<description>enforcing - SELinux security policy is enforced.
<br />permissive - SELinux prints warnings instead of enforcing.
@@ -103,7 +103,7 @@ the chances that it will remain off during system operation.
<tested by="DS" on="20121024"/>
</Rule>
-<Rule id="set_selinux_state" severity="medium">
+<Rule id="selinux_state" severity="medium">
<title>Ensure SELinux State is Enforcing</title>
<description>The SELinux state should be set to <tt>enforcing</tt> at
system boot time. In the file <tt>/etc/selinux/config</tt>, add or correct the
@@ -121,7 +121,7 @@ prevent them from causing damage to the system or further elevating their
privileges.
</rationale>
<ident cce="26969-6" />
-<oval id="selinux_mode" value="var_selinux_state_name"/>
+<oval id="selinux_state" value="var_selinux_state"/>
<ref nist="AC-3,AC-3(3),AC-4,AC-6,AU-9" disa="22,32,26"/>
<tested by="DS" on="20121024"/>
</Rule>
--
1.7.1
More information about the scap-security-guide
mailing list