[PATCH] [Fedora] Introduce 'Ensure SELinux Not Disabled in Currently Running Kernel' rule
Peter Vrabec
pvrabec at redhat.com
Mon Oct 7 14:49:28 UTC 2013
Hi Shawn,
I assume you need to define a scope whether runtime settings should be
covered or not. My assumption was that the guide is about configuration
settings.
http://scap-securityguide.rhcloud.com/RHEL6/output/rhel6-guide.html
"This guide presents a catalog of security-relevant configuration
settings ... "
Peter.
On 10/07/2013 04:40 AM, Shawn Wells wrote:
> On 10/5/13 12:07 PM, fcaviggi at redhat.com wrote:
>> Shawn,
>>
>> If these files exist and contain '1':
>>
>> '/selinux/enforce' - RHEL 6
>> '/sys/fs/selinux/enforce' - Fedora 19
>>
>> Then SELinux is enabled and enforcing - the filesystem can only exist
>> if SELinux is enabled, the contents are the enforcement status.
>
> So then, should we update the existing SELinux OVAL to check for both
> the static /etc/selinux/config *and* runtime /selinux/enforce values?
> _______________________________________________
> scap-security-guide mailing list
> scap-security-guide at lists.fedorahosted.org
> https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide
More information about the scap-security-guide
mailing list