<html>
  <head>
    <meta content="text/html; charset=UTF-8" http-equiv="Content-Type">
  </head>
  <body bgcolor="#FFFFFF" text="#000000">
    <div class="moz-cite-prefix">On 9/3/13 3:59 PM, Maura Dailey wrote:<br>
    </div>
    <blockquote cite="mid:52263F93.4090202@eclipse.ncsc.mil" type="cite">On
      09/03/2013 03:56 PM, Maura Dailey wrote:
      <br>
      <blockquote type="cite" style="color: #000000;">On 09/03/2013
        12:46 PM, Shawn Wells wrote:
        <br>
        <blockquote type="cite" style="color: #000000;">On 9/3/13 12:45
          PM, Shawn Wells wrote:
          <br>
          <blockquote type="cite" style="color: #000000;">On 9/2/13
            10:42 PM, Jeffrey Blank wrote:
            <br>
            <blockquote type="cite" style="color: #000000;">Looks like a
              great improvement to me, please push.  At some point in
              <br>
              the future, it seems we'll have to adjust for EFI systems,
              which (as
              <br>
              Maura has noted elsewhere, right?) seem (rather
              obnoxiously) to not
              <br>
              use a file linked from /etc/grub.conf.
              <br>
            </blockquote>
            It's an improvement, in that the OVAL check no longer errors
            out. I believe this was the last OVAL error to be fixed!
            <br>
            <br>
            In adjusting the existing OVAL, I noted the check fails upon
            existence of (selinux|enforcing)=0 anywhere in grub.conf.
            Meaning, if we set enforcing=4 the check will still pass,
            though I believe this is an invalid option (I couldn't find
            anything on google regarding this).
            <br>
            <br>
            I updated the regex to scan for selinux|enforcing=1, however
            if you have multiple kernel stanzas, and <b
              class="moz-txt-star"><span class="moz-txt-tag">*</span>any<span
                class="moz-txt-tag">*</span></b> of them have
            selinux|enforcing=1, it will pass even if others have
            selinux|enforcing=0.
            <br>
            <br>
            I couldn't figure out how to ensure <b class="moz-txt-star"><span
                class="moz-txt-tag">*</span>all<span class="moz-txt-tag">*</span></b>
            stanzas have selinux|enforcing=1.... can anyone help with
            this?
            <br>
          </blockquote>
          <br>
          oh, p.s., I pushed the fix per jeff's ack:
          <br>
          <a moz-do-not-send="true" class="moz-txt-link-freetext"
href="https://git.fedorahosted.org/cgit/scap-security-guide.git/commit/?id=1253b6e4048f575d0be802b8db0c1a0964ec6619">https://git.fedorahosted.org/cgit/scap-security-guide.git/commit/?id=1253b6e4048f575d0be802b8db0c1a0964ec6619</a>
          <br>
          _______________________________________________
          <br>
          scap-security-guide mailing list
          <br>
          <a moz-do-not-send="true" class="moz-txt-link-abbreviated"
            href="mailto:scap-security-guide@lists.fedorahosted.org">scap-security-guide@lists.fedorahosted.org</a>
          <br>
          <a moz-do-not-send="true" class="moz-txt-link-freetext"
href="https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide">https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide</a>
          <br>
        </blockquote>
        <br>
        <br>
        A few points. First, I tried selinux=4 on the kernel line and it
        booted properly and was still enforcing. I'll try enforcing=4
        next and report back if it fails. Second, let's leave it at
        searching for disabled values. That's what the prose says, and
        there is NO requirement to use grub.conf to attempt to enable
        SELinux. In fact, if it's disabled elsewhere, enabling it in
        grub.conf probably isn't even guaranteed to work. I don't know
        what options override what. I suspect SELinux would remain
        disabled if /etc/selinux/config was set to disable it.
        <br>
        <br>
        Lastly, about the patch, I had an uncommitted patch to the same
        file which is essentially the same with a few small differences.
        If possible, could we change the id names to match the id for
        the check? (test_selinux_bootloader_notdisabled instead of
        test_selinux_grub, for example) Also, could we delete the extra
        spacing around the description so that it's all on one line?
        Extra spacing inside tags could potentially screw something up
        if it's parsed by an XSLT later. I know it screws up the HTML
        display of XCCDF content.
        <br>
        <br>
        Thanks,
        <br>
        - Maura Dailey
        <br>
        _______________________________________________
        <br>
        scap-security-guide mailing list
        <br>
        <a moz-do-not-send="true" class="moz-txt-link-abbreviated"
          href="mailto:scap-security-guide@lists.fedorahosted.org">scap-security-guide@lists.fedorahosted.org</a>
        <br>
        <a moz-do-not-send="true" class="moz-txt-link-freetext"
href="https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide">https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide</a>
        <br>
      </blockquote>
      <br>
      Addendum: enforcing=4 has no effect. SELinux is still turned on
      and Enforcing.
    </blockquote>
    Thank you!<br>
    <br>
    In regards to the ID name &amp; spacing, I'm going into meetings for
    the rest of the day. If you're up to it, I'd say push a patch for
    these as a bugfix.... OVAL ID should definitely match XCCDF rule id!<br>
  </body>
</html>