[PATCH] [bugfix] Updated selinux_bootloader_notdisabled per ticket 391

Shawn Wells shawn at redhat.com
Tue Sep 3 16:46:27 UTC 2013


On 9/3/13 12:45 PM, Shawn Wells wrote:
> On 9/2/13 10:42 PM, Jeffrey Blank wrote:
>> Looks like a great improvement to me, please push.  At some point in
>> the future, it seems we'll have to adjust for EFI systems, which (as
>> Maura has noted elsewhere, right?) seem (rather obnoxiously) to not
>> use a file linked from /etc/grub.conf.
> It's an improvement, in that the OVAL check no longer errors out. I 
> believe this was the last OVAL error to be fixed!
>
> In adjusting the existing OVAL, I noted the check fails upon existence 
> of (selinux|enforcing)=0 anywhere in grub.conf. Meaning, if we set 
> enforcing=4 the check will still pass, though I believe this is an 
> invalid option (I couldn't find anything on google regarding this).
>
> I updated the regex to scan for selinux|enforcing=1, however if you 
> have multiple kernel stanzas, and *any* of them have 
> selinux|enforcing=1, it will pass even if others have 
> selinux|enforcing=0.
>
> I couldn't figure out how to ensure *all* stanzas have 
> selinux|enforcing=1.... can anyone help with this?

oh, p.s., I pushed the fix per jeff's ack:
https://git.fedorahosted.org/cgit/scap-security-guide.git/commit/?id=1253b6e4048f575d0be802b8db0c1a0964ec6619


More information about the scap-security-guide mailing list