[PATCH] [bugfix] Updated selinux_bootloader_notdisabled per ticket 391

Shawn Wells shawn at redhat.com
Tue Sep 3 16:45:31 UTC 2013


On 9/2/13 10:42 PM, Jeffrey Blank wrote:
> Looks like a great improvement to me, please push.  At some point in
> the future, it seems we'll have to adjust for EFI systems, which (as
> Maura has noted elsewhere, right?) seem (rather obnoxiously) to not
> use a file linked from /etc/grub.conf.
It's an improvement, in that the OVAL check no longer errors out. I 
believe this was the last OVAL error to be fixed!

In adjusting the existing OVAL, I noted the check fails upon existence 
of (selinux|enforcing)=0 anywhere in grub.conf. Meaning, if we set 
enforcing=4 the check will still pass, though I believe this is an 
invalid option (I couldn't find anything on google regarding this).

I updated the regex to scan for selinux|enforcing=1, however if you have 
multiple kernel stanzas, and *any* of them have selinux|enforcing=1, it 
will pass even if others have selinux|enforcing=0.

I couldn't figure out how to ensure *all* stanzas have 
selinux|enforcing=1.... can anyone help with this?


More information about the scap-security-guide mailing list