<html>
<head>
<meta content="text/html; charset=UTF-8" http-equiv="Content-Type">
</head>
<body bgcolor="#FFFFFF" text="#000000">
<div class="moz-cite-prefix">On 9/30/12 12:34 AM, Michael J.
McConachie wrote:<br>
</div>
<blockquote cite="mid:20120930043406.GA5620@mobile.dude.localdomain"
type="cite"><br>
<fieldset class="mimeAttachmentHeader"><legend
class="mimeAttachmentHeaderName">0005-Test-Tags-added-for-input-system-selinux.xml.patch</legend></fieldset>
<br>
<div class="moz-text-plain" wrap="true" graphical-quote="true"
style="font-family: -moz-fixed; font-size: 12px;"
lang="x-western">
<pre wrap="">From 5f7d2293a2df184a27fe5516e31597005ee1e188 Mon Sep 17 00:00:00 2001
From: Michael McConachie <a moz-do-not-send="true" class="moz-txt-link-rfc2396E" href="mailto:michael@redhat.com"><michael@redhat.com></a>
Date: Sun, 30 Sep 2012 00:31:14 -0400
Subject: [PATCH 5/6] Test Tags added for input/system/selinux.xml
---
RHEL6/input/system/selinux.xml | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/RHEL6/input/system/selinux.xml b/RHEL6/input/system/selinux.xml
index 286f324..23f7875 100644
--- a/RHEL6/input/system/selinux.xml
+++ b/RHEL6/input/system/selinux.xml
@@ -102,6 +102,7 @@ the chances that it will remain off during system operation.
<ident cce="3977-6" />
<oval id="selinux_bootloader_notdisabled" />
<ref nist="AC-3, CM-6" />
+<tested by="MM" on="20120929"/>
</Rule></pre>
</div>
</blockquote>
<br>
nack<br>
<br>
OCIL text should show a trivial command (likely grep?) for this, vs
giving general instructions on the need to human review a file<br>
<br>
<br>
<blockquote cite="mid:20120930043406.GA5620@mobile.dude.localdomain"
type="cite">
<div class="moz-text-plain" wrap="true" graphical-quote="true"
style="font-family: -moz-fixed; font-size: 12px;"
lang="x-western">
<pre wrap=""> <Rule id="set_selinux_state">
@@ -124,6 +125,7 @@ privileges.
<ident cce="3999-0" />
<oval id="selinux_mode" value="var_selinux_state_name"/>
<ref nist="CM-6, CM-7" disa="22"/>
+<tested by="MM" on="20120929"/>
</Rule></pre>
</div>
</blockquote>
nack<br>
<br>
selinux should be set to enabled in grub config as well, similar to
how we put audit=1 <br>
<br>
<blockquote cite="mid:20120930043406.GA5620@mobile.dude.localdomain"
type="cite">
<div class="moz-text-plain" wrap="true" graphical-quote="true"
style="font-family: -moz-fixed; font-size: 12px;"
lang="x-western">
<pre wrap=""> <Rule id="set_selinux_policy">
@@ -149,6 +151,7 @@ targeted for exploitation, such as network services or system services.
<ident cce="3624-4" />
<oval id="selinux_policytype" value="var_selinux_policy_name"/>
<ref nist="CM-6, CM-7" />
+<tested by="MM" on="20120929"/>
</Rule>
</Group></pre>
</div>
</blockquote>
nack<br>
<br>
as written, if a system is configured as MLS it will be a (very
false) finding. OCIL text should reflect SELINUXTYPE value can be <i>either</i>
targeted or mls<br>
<br>
<blockquote cite="mid:20120930043406.GA5620@mobile.dude.localdomain"
type="cite">
<div class="moz-text-plain" wrap="true" graphical-quote="true"
style="font-family: -moz-fixed; font-size: 12px;"
lang="x-western">
<pre wrap="">
@@ -243,6 +246,7 @@ If a device file is not labeled, then misconfiguration is likely.
<ident cce="14991-4" />
<oval id="selinux_all_devicefiles_labeled" />
<ref nist="CM-6, CM-7" />
+<tested by="MM" on="20120929"/>
</Rule>
</Group></pre>
</div>
</blockquote>
nack<br>
- language of description still choppy<br>
- OCIL command not adequate. Why not use "ls -RZ / | grep
unlabeled_t"? Or a find -context unlabeled_t?<br>
</body>
</html>