[PATCH] [bugfix] Updated selinux_bootloader_notdisabled per ticket 391

Maura Dailey maura at eclipse.ncsc.mil
Tue Sep 3 19:56:31 UTC 2013


On 09/03/2013 12:46 PM, Shawn Wells wrote:
> On 9/3/13 12:45 PM, Shawn Wells wrote:
>> On 9/2/13 10:42 PM, Jeffrey Blank wrote:
>>> Looks like a great improvement to me, please push.  At some point in
>>> the future, it seems we'll have to adjust for EFI systems, which (as
>>> Maura has noted elsewhere, right?) seem (rather obnoxiously) to not
>>> use a file linked from /etc/grub.conf.
>> It's an improvement, in that the OVAL check no longer errors out. I 
>> believe this was the last OVAL error to be fixed!
>>
>> In adjusting the existing OVAL, I noted the check fails upon 
>> existence of (selinux|enforcing)=0 anywhere in grub.conf. Meaning, if 
>> we set enforcing=4 the check will still pass, though I believe this 
>> is an invalid option (I couldn't find anything on google regarding 
>> this).
>>
>> I updated the regex to scan for selinux|enforcing=1, however if you 
>> have multiple kernel stanzas, and *any* of them have 
>> selinux|enforcing=1, it will pass even if others have 
>> selinux|enforcing=0.
>>
>> I couldn't figure out how to ensure *all* stanzas have 
>> selinux|enforcing=1.... can anyone help with this?
>
> oh, p.s., I pushed the fix per jeff's ack:
> https://git.fedorahosted.org/cgit/scap-security-guide.git/commit/?id=1253b6e4048f575d0be802b8db0c1a0964ec6619 
>
> _______________________________________________
> scap-security-guide mailing list
> scap-security-guide at lists.fedorahosted.org
> https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide


A few points. First, I tried selinux=4 on the kernel line and it booted 
properly and was still enforcing. I'll try enforcing=4 next and report 
back if it fails. Second, let's leave it at searching for disabled 
values. That's what the prose says, and there is NO requirement to use 
grub.conf to attempt to enable SELinux. In fact, if it's disabled 
elsewhere, enabling it in grub.conf probably isn't even guaranteed to 
work. I don't know what options override what. I suspect SELinux would 
remain disabled if /etc/selinux/config was set to disable it.

Lastly, about the patch, I had an uncommitted patch to the same file 
which is essentially the same with a few small differences. If possible, 
could we change the id names to match the id for the check? 
(test_selinux_bootloader_notdisabled instead of test_selinux_grub, for 
example) Also, could we delete the extra spacing around the description 
so that it's all on one line? Extra spacing inside tags could 
potentially screw something up if it's parsed by an XSLT later. I know 
it screws up the HTML display of XCCDF content.

Thanks,
- Maura Dailey


More information about the scap-security-guide mailing list