[PATCH 2/3] minor edits to selinux and integrity sections

Shawn Wells shawn at redhat.com
Wed Mar 26 17:29:38 UTC 2014


On 3/6/14, 12:08 AM, Jeffrey Blank wrote:
> diff --git a/RHEL/6/input/system/software/integrity.xml b/RHEL/6/input/system/software/integrity.xml
> index 3d28c78..55bf115 100644
> --- a/RHEL/6/input/system/software/integrity.xml
> +++ b/RHEL/6/input/system/software/integrity.xml
> @@ -190,13 +190,15 @@ software may not be appropriate for some specialized systems.
>   <Rule id="install_hids" severity="high">
>   <title>Install Intrusion Detection Software</title>
>   <description>
> -The Red Hat platform includes a sophisticated auditing system
> -and SELinux, which provide host-based intrusion detection capabilities.
> +The base Red Hat platform already includes a sophisticated auditing system that
> +can detect intruder activity, as well as SELinux, which provides host-based
> +intrusion prevention capabilities by confining privileged programs and user
> +sessions which may become compromised.
> +<br/>
>   </description>
> -<ocil clause="SELinux is installed, this is not a finding.  However, if neither SELinux nor HBSS is used on the system">
> +<ocil clause="no host-based intrusion detection tools are installed">
>   Inspect the system to determine if intrusion detection software has been installed.
> -SELinux is the intrusion detection system included with RHEL. Another one is
> -McAfee HBSS, which is available through Cybercom.
> +Verify this intrusion detection software is active.
>   </ocil>
>   <rationale>
>   Host-based intrusion detection tools provide a system-level defense when an

I've been on PTO for a few weeks, so this slipped through. I saw Dave 
gave an ack, but I'd like to throw a flag.

This language is extremely important to keep the same. It took *years* 
to get DoD to accept that if SELinux is installed they don't need HBSS. 
Why the reverting of the OCIL clause? This will have ripple effects 
across the DoD -- can you provide some justification?


More information about the scap-security-guide mailing list