[PATCH] [bugfix] Updated selinux_bootloader_notdisabled per ticket 391

Maura Dailey maura at eclipse.ncsc.mil
Tue Sep 3 19:59:15 UTC 2013


On 09/03/2013 03:56 PM, Maura Dailey wrote:
> On 09/03/2013 12:46 PM, Shawn Wells wrote:
>> On 9/3/13 12:45 PM, Shawn Wells wrote:
>>> On 9/2/13 10:42 PM, Jeffrey Blank wrote:
>>>> Looks like a great improvement to me, please push.  At some point in
>>>> the future, it seems we'll have to adjust for EFI systems, which (as
>>>> Maura has noted elsewhere, right?) seem (rather obnoxiously) to not
>>>> use a file linked from /etc/grub.conf.
>>> It's an improvement, in that the OVAL check no longer errors out. I 
>>> believe this was the last OVAL error to be fixed!
>>>
>>> In adjusting the existing OVAL, I noted the check fails upon 
>>> existence of (selinux|enforcing)=0 anywhere in grub.conf. Meaning, 
>>> if we set enforcing=4 the check will still pass, though I believe 
>>> this is an invalid option (I couldn't find anything on google 
>>> regarding this).
>>>
>>> I updated the regex to scan for selinux|enforcing=1, however if you 
>>> have multiple kernel stanzas, and *any* of them have 
>>> selinux|enforcing=1, it will pass even if others have 
>>> selinux|enforcing=0.
>>>
>>> I couldn't figure out how to ensure *all* stanzas have 
>>> selinux|enforcing=1.... can anyone help with this?
>>
>> oh, p.s., I pushed the fix per jeff's ack:
>> https://git.fedorahosted.org/cgit/scap-security-guide.git/commit/?id=1253b6e4048f575d0be802b8db0c1a0964ec6619 
>>
>> _______________________________________________
>> scap-security-guide mailing list
>> scap-security-guide at lists.fedorahosted.org
>> https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide
>
>
> A few points. First, I tried selinux=4 on the kernel line and it 
> booted properly and was still enforcing. I'll try enforcing=4 next and 
> report back if it fails. Second, let's leave it at searching for 
> disabled values. That's what the prose says, and there is NO 
> requirement to use grub.conf to attempt to enable SELinux. In fact, if 
> it's disabled elsewhere, enabling it in grub.conf probably isn't even 
> guaranteed to work. I don't know what options override what. I suspect 
> SELinux would remain disabled if /etc/selinux/config was set to 
> disable it.
>
> Lastly, about the patch, I had an uncommitted patch to the same file 
> which is essentially the same with a few small differences. If 
> possible, could we change the id names to match the id for the check? 
> (test_selinux_bootloader_notdisabled instead of test_selinux_grub, for 
> example) Also, could we delete the extra spacing around the 
> description so that it's all on one line? Extra spacing inside tags 
> could potentially screw something up if it's parsed by an XSLT later. 
> I know it screws up the HTML display of XCCDF content.
>
> Thanks,
> - Maura Dailey
> _______________________________________________
> scap-security-guide mailing list
> scap-security-guide at lists.fedorahosted.org
> https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide

Addendum: enforcing=4 has no effect. SELinux is still turned on and 
Enforcing.


More information about the scap-security-guide mailing list