[PATCH] [bugfix] Updated selinux_bootloader_notdisabled per ticket 391

Shawn Wells shawn at redhat.com
Tue Sep 3 20:00:56 UTC 2013


On 9/3/13 3:59 PM, Maura Dailey wrote:
> On 09/03/2013 03:56 PM, Maura Dailey wrote:
>> On 09/03/2013 12:46 PM, Shawn Wells wrote:
>>> On 9/3/13 12:45 PM, Shawn Wells wrote:
>>>> On 9/2/13 10:42 PM, Jeffrey Blank wrote:
>>>>> Looks like a great improvement to me, please push.  At some point in
>>>>> the future, it seems we'll have to adjust for EFI systems, which (as
>>>>> Maura has noted elsewhere, right?) seem (rather obnoxiously) to not
>>>>> use a file linked from /etc/grub.conf.
>>>> It's an improvement, in that the OVAL check no longer errors out. I 
>>>> believe this was the last OVAL error to be fixed!
>>>>
>>>> In adjusting the existing OVAL, I noted the check fails upon 
>>>> existence of (selinux|enforcing)=0 anywhere in grub.conf. Meaning, 
>>>> if we set enforcing=4 the check will still pass, though I believe 
>>>> this is an invalid option (I couldn't find anything on google 
>>>> regarding this).
>>>>
>>>> I updated the regex to scan for selinux|enforcing=1, however if you 
>>>> have multiple kernel stanzas, and *any* of them have 
>>>> selinux|enforcing=1, it will pass even if others have 
>>>> selinux|enforcing=0.
>>>>
>>>> I couldn't figure out how to ensure *all* stanzas have 
>>>> selinux|enforcing=1.... can anyone help with this?
>>>
>>> oh, p.s., I pushed the fix per jeff's ack:
>>> https://git.fedorahosted.org/cgit/scap-security-guide.git/commit/?id=1253b6e4048f575d0be802b8db0c1a0964ec6619 
>>>
>>> _______________________________________________
>>> scap-security-guide mailing list
>>> scap-security-guide at lists.fedorahosted.org
>>> https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide
>>
>>
>> A few points. First, I tried selinux=4 on the kernel line and it 
>> booted properly and was still enforcing. I'll try enforcing=4 next 
>> and report back if it fails. Second, let's leave it at searching for 
>> disabled values. That's what the prose says, and there is NO 
>> requirement to use grub.conf to attempt to enable SELinux. In fact, 
>> if it's disabled elsewhere, enabling it in grub.conf probably isn't 
>> even guaranteed to work. I don't know what options override what. I 
>> suspect SELinux would remain disabled if /etc/selinux/config was set 
>> to disable it.
>>
>> Lastly, about the patch, I had an uncommitted patch to the same file 
>> which is essentially the same with a few small differences. If 
>> possible, could we change the id names to match the id for the check? 
>> (test_selinux_bootloader_notdisabled instead of test_selinux_grub, 
>> for example) Also, could we delete the extra spacing around the 
>> description so that it's all on one line? Extra spacing inside tags 
>> could potentially screw something up if it's parsed by an XSLT later. 
>> I know it screws up the HTML display of XCCDF content.
>>
>> Thanks,
>> - Maura Dailey
>> _______________________________________________
>> scap-security-guide mailing list
>> scap-security-guide at lists.fedorahosted.org
>> https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide
>
> Addendum: enforcing=4 has no effect. SELinux is still turned on and 
> Enforcing. 
Thank you!

In regards to the ID name & spacing, I'm going into meetings for the 
rest of the day. If you're up to it, I'd say push a patch for these as a 
bugfix.... OVAL ID should definitely match XCCDF rule id!
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.fedorahosted.org/pipermail/scap-security-guide/attachments/20130903/7d813e92/attachment-0001.html>


More information about the scap-security-guide mailing list