[PATCH] [bugfix] Updated selinux_bootloader_notdisabled per ticket 391
Shawn Wells
shawn at redhat.com
Tue Sep 3 20:00:56 UTC 2013
On 9/3/13 3:59 PM, Maura Dailey wrote:
> On 09/03/2013 03:56 PM, Maura Dailey wrote:
>> On 09/03/2013 12:46 PM, Shawn Wells wrote:
>>> On 9/3/13 12:45 PM, Shawn Wells wrote:
>>>> On 9/2/13 10:42 PM, Jeffrey Blank wrote:
>>>>> Looks like a great improvement to me, please push. At some point in
>>>>> the future, it seems we'll have to adjust for EFI systems, which (as
>>>>> Maura has noted elsewhere, right?) seem (rather obnoxiously) to not
>>>>> use a file linked from /etc/grub.conf.
>>>> It's an improvement, in that the OVAL check no longer errors out. I
>>>> believe this was the last OVAL error to be fixed!
>>>>
>>>> In adjusting the existing OVAL, I noted the check fails upon
>>>> existence of (selinux|enforcing)=0 anywhere in grub.conf. Meaning,
>>>> if we set enforcing=4 the check will still pass, though I believe
>>>> this is an invalid option (I couldn't find anything on google
>>>> regarding this).
>>>>
>>>> I updated the regex to scan for selinux|enforcing=1, however if you
>>>> have multiple kernel stanzas, and *any* of them have
>>>> selinux|enforcing=1, it will pass even if others have
>>>> selinux|enforcing=0.
>>>>
>>>> I couldn't figure out how to ensure *all* stanzas have
>>>> selinux|enforcing=1.... can anyone help with this?
>>>
>>> oh, p.s., I pushed the fix per jeff's ack:
>>> https://git.fedorahosted.org/cgit/scap-security-guide.git/commit/?id=1253b6e4048f575d0be802b8db0c1a0964ec6619
>>>
>>> _______________________________________________
>>> scap-security-guide mailing list
>>> scap-security-guide at lists.fedorahosted.org
>>> https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide
>>
>>
>> A few points. First, I tried selinux=4 on the kernel line and it
>> booted properly and was still enforcing. I'll try enforcing=4 next
>> and report back if it fails. Second, let's leave it at searching for
>> disabled values. That's what the prose says, and there is NO
>> requirement to use grub.conf to attempt to enable SELinux. In fact,
>> if it's disabled elsewhere, enabling it in grub.conf probably isn't
>> even guaranteed to work. I don't know what options override what. I
>> suspect SELinux would remain disabled if /etc/selinux/config was set
>> to disable it.
>>
>> Lastly, about the patch, I had an uncommitted patch to the same file
>> which is essentially the same with a few small differences. If
>> possible, could we change the id names to match the id for the check?
>> (test_selinux_bootloader_notdisabled instead of test_selinux_grub,
>> for example) Also, could we delete the extra spacing around the
>> description so that it's all on one line? Extra spacing inside tags
>> could potentially screw something up if it's parsed by an XSLT later.
>> I know it screws up the HTML display of XCCDF content.
>>
>> Thanks,
>> - Maura Dailey
>> _______________________________________________
>> scap-security-guide mailing list
>> scap-security-guide at lists.fedorahosted.org
>> https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide
>
> Addendum: enforcing=4 has no effect. SELinux is still turned on and
> Enforcing.
Thank you!
In regards to the ID name & spacing, I'm going into meetings for the
rest of the day. If you're up to it, I'd say push a patch for these as a
bugfix.... OVAL ID should definitely match XCCDF rule id!
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.fedorahosted.org/pipermail/scap-security-guide/attachments/20130903/7d813e92/attachment-0001.html>
More information about the scap-security-guide
mailing list