[PATCH] [Fedora] Introduce 'Ensure SELinux Not Disabled in Currently Running Kernel' rule

Shawn Wells shawn at redhat.com
Mon Oct 7 02:40:48 UTC 2013


On 10/5/13 12:07 PM, fcaviggi at redhat.com wrote:
> Shawn,
>
> If these files exist and contain '1':
>
>     '/selinux/enforce' - RHEL 6
>     '/sys/fs/selinux/enforce' - Fedora 19
>
> Then SELinux is enabled and enforcing - the filesystem can only exist 
> if SELinux is enabled, the contents are the enforcement status.

So then, should we update the existing SELinux OVAL to check for both 
the static /etc/selinux/config *and* runtime /selinux/enforce values?


More information about the scap-security-guide mailing list