[PATCH] [Fedora] Introduce 'Ensure SELinux Not Disabled in Currently Running Kernel' rule

Peter Vrabec pvrabec at redhat.com
Mon Oct 7 14:49:28 UTC 2013


Hi Shawn,

I assume you need to define a scope whether runtime settings should be 
covered or not. My assumption was that the guide is about configuration 
settings.

http://scap-securityguide.rhcloud.com/RHEL6/output/rhel6-guide.html

"This guide presents a catalog of security-relevant configuration 
settings  ... "

Peter.




On 10/07/2013 04:40 AM, Shawn Wells wrote:
> On 10/5/13 12:07 PM, fcaviggi at redhat.com wrote:
>> Shawn,
>>
>> If these files exist and contain '1':
>>
>>     '/selinux/enforce' - RHEL 6
>>     '/sys/fs/selinux/enforce' - Fedora 19
>>
>> Then SELinux is enabled and enforcing - the filesystem can only exist
>> if SELinux is enabled, the contents are the enforcement status.
>
> So then, should we update the existing SELinux OVAL to check for both
> the static /etc/selinux/config *and* runtime /selinux/enforce values?
> _______________________________________________
> scap-security-guide mailing list
> scap-security-guide at lists.fedorahosted.org
> https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide



More information about the scap-security-guide mailing list