[PATCH] [Fedora] Introduce 'Ensure SELinux Not Disabled in Currently Running Kernel' rule

fcaviggi at redhat.com fcaviggi at redhat.com
Sat Oct 5 16:07:39 UTC 2013


Shawn,

If these files exist and contain '1':

     '/selinux/enforce' - RHEL 6
     '/sys/fs/selinux/enforce' - Fedora 19

Then SELinux is enabled and enforcing - the filesystem can only exist if 
SELinux is enabled, the contents are the enforcement status.

-Frank


On 10/04/2013 11:04 PM, Shawn Wells wrote:
> On 10/4/13 2:55 PM, fcaviggi at redhat.com wrote:
>> Jan,
>>
>> Doh. The '/selinux/enforce' was RHEL 6 - for Fedora 19 - it's 
>> '/sys/fs/selinux/enforce'
>>
>> -Frank
>>
>>
>> On 10/04/2013 02:49 PM, fcaviggi at redhat.com wrote:
>>> Jan,
>>>
>>> You might consider checking if the '/selinux/enforce' file exists 
>>> and the file contains '1' (1 is enforcing). That would ensure that 
>>> SELinux enabled and enforcing the policy.
>>>
>>> Regards,
>>>
>>> Frank Caviggia
>>>
>>>
>>> On 10/04/2013 01:11 PM, Jan Lieskovsky wrote:
>>>> Introduce new SELinux section of the guide and first rule
>>>> for it - check if SELinux is enabled in currently
>>>> booted kernel.
>>>>
>>>> Please review.
>>>>
>>>> Thank you && Regards, Jan.
>>>> --
>>>> Jan iankko Lieskovsky / Red Hat Security Technologies Team
>>>>
>
> Within the OVAL:
>
> +  <ind:textfilecontent54_test check="all" 
> check_existence="only_one_exists" comment="check for existence of 
> selinuxfs in /proc/mounts file" 
> id="test_ensure_selinuxfs_in_proc_mounts" version="1" >
> +    <ind:object object_ref="obj_ensure_selinuxfs_in_proc_mounts" />
> +  </ind:textfilecontent54_test>
> +  <ind:textfilecontent54_object 
> id="obj_ensure_selinuxfs_in_proc_mounts" version="1">
> +    <ind:filepath>/proc/mounts</ind:filepath>
> +    <ind:pattern operation="pattern 
> match">^\s*selinuxfs\s*/sys/fs/selinux\s*selinuxfs\s*rw,relatime\s*0\s*0\s*$</ind:pattern>
> +    <ind:instance datatype="int" operation="equals">1</ind:instance>
> +  </ind:textfilecontent54_object>
>
>
> Caviggia and I were chatting earlier today.... while the /proc/mounts 
> reflects that selinux is loaded into the kernel, IIRC, it doesn't 
> indicate that it's actually *enforcing* on the system. This poses an 
> interesting challenge...
>
> Within the RHEL6 content, we:
> - Check for selinux=1 within grub
> - Check for SELINUX=enforcing within /etc/selinux/config
>
> These checks do not reflect *runtime* enablement of SELinux, but 
> unfortunately neither does /proc/mounts:
>> [shawn at SSG-RHEL6 checks]$ getenforce
>> Enforcing
>>
>> [shawn at SSG-RHEL6 checks]$ cat /proc/mounts | grep selinux
>> none /selinux selinuxfs rw,relatime 0 0
>>
>> [shawn at SSG-RHEL6 checks]$ sudo setenforce 0
>> [sudo] password for shawn:
>>
>> [shawn at SSG-RHEL6 checks]$ cat /proc/mounts | grep selinux
>> none /selinux selinuxfs rw,relatime 0 0
> Is there another crafty way to verify that selinux is *enforcing*? 
> Perhaps checking the value in /etc/selinux instead?
>> [shawn at SSG-RHEL6 self]$ cat /selinux/enforce
>> 1
>> [shawn at SSG-RHEL6 self]$ sudo setenforce 0
>>
>> [shawn at SSG-RHEL6 self]$ cat /selinux/enforce
>> 0
> If that's a non-reputable source of SELinux enablement, we should add 
> an appropriate XCCDF and OVAL rule to Fedora & RHEL streams.
>
>
> _______________________________________________
> scap-security-guide mailing list
> scap-security-guide at lists.fedorahosted.org
> https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide


-- 
Frank Caviggia
Consultant, Public Sector
fcaviggi at redhat.com
(M) (571) 295-4560

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.fedorahosted.org/pipermail/scap-security-guide/attachments/20131005/7a845064/attachment.html>


More information about the scap-security-guide mailing list