<html>
<head>
<meta content="text/html; charset=UTF-8" http-equiv="Content-Type">
</head>
<body bgcolor="#FFFFFF" text="#000000">
<div class="moz-cite-prefix">On 9/3/13 3:59 PM, Maura Dailey wrote:<br>
</div>
<blockquote cite="mid:52263F93.4090202@eclipse.ncsc.mil" type="cite">On
09/03/2013 03:56 PM, Maura Dailey wrote:
<br>
<blockquote type="cite" style="color: #000000;">On 09/03/2013
12:46 PM, Shawn Wells wrote:
<br>
<blockquote type="cite" style="color: #000000;">On 9/3/13 12:45
PM, Shawn Wells wrote:
<br>
<blockquote type="cite" style="color: #000000;">On 9/2/13
10:42 PM, Jeffrey Blank wrote:
<br>
<blockquote type="cite" style="color: #000000;">Looks like a
great improvement to me, please push. At some point in
<br>
the future, it seems we'll have to adjust for EFI systems,
which (as
<br>
Maura has noted elsewhere, right?) seem (rather
obnoxiously) to not
<br>
use a file linked from /etc/grub.conf.
<br>
</blockquote>
It's an improvement, in that the OVAL check no longer errors
out. I believe this was the last OVAL error to be fixed!
<br>
<br>
In adjusting the existing OVAL, I noted the check fails upon
existence of (selinux|enforcing)=0 anywhere in grub.conf.
Meaning, if we set enforcing=4 the check will still pass,
though I believe this is an invalid option (I couldn't find
anything on google regarding this).
<br>
<br>
I updated the regex to scan for selinux|enforcing=1, however
if you have multiple kernel stanzas, and <b
class="moz-txt-star"><span class="moz-txt-tag">*</span>any<span
class="moz-txt-tag">*</span></b> of them have
selinux|enforcing=1, it will pass even if others have
selinux|enforcing=0.
<br>
<br>
I couldn't figure out how to ensure <b class="moz-txt-star"><span
class="moz-txt-tag">*</span>all<span class="moz-txt-tag">*</span></b>
stanzas have selinux|enforcing=1.... can anyone help with
this?
<br>
</blockquote>
<br>
oh, p.s., I pushed the fix per jeff's ack:
<br>
<a moz-do-not-send="true" class="moz-txt-link-freetext"
href="https://git.fedorahosted.org/cgit/scap-security-guide.git/commit/?id=1253b6e4048f575d0be802b8db0c1a0964ec6619">https://git.fedorahosted.org/cgit/scap-security-guide.git/commit/?id=1253b6e4048f575d0be802b8db0c1a0964ec6619</a>
<br>
_______________________________________________
<br>
scap-security-guide mailing list
<br>
<a moz-do-not-send="true" class="moz-txt-link-abbreviated"
href="mailto:scap-security-guide@lists.fedorahosted.org">scap-security-guide@lists.fedorahosted.org</a>
<br>
<a moz-do-not-send="true" class="moz-txt-link-freetext"
href="https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide">https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide</a>
<br>
</blockquote>
<br>
<br>
A few points. First, I tried selinux=4 on the kernel line and it
booted properly and was still enforcing. I'll try enforcing=4
next and report back if it fails. Second, let's leave it at
searching for disabled values. That's what the prose says, and
there is NO requirement to use grub.conf to attempt to enable
SELinux. In fact, if it's disabled elsewhere, enabling it in
grub.conf probably isn't even guaranteed to work. I don't know
what options override what. I suspect SELinux would remain
disabled if /etc/selinux/config was set to disable it.
<br>
<br>
Lastly, about the patch, I had an uncommitted patch to the same
file which is essentially the same with a few small differences.
If possible, could we change the id names to match the id for
the check? (test_selinux_bootloader_notdisabled instead of
test_selinux_grub, for example) Also, could we delete the extra
spacing around the description so that it's all on one line?
Extra spacing inside tags could potentially screw something up
if it's parsed by an XSLT later. I know it screws up the HTML
display of XCCDF content.
<br>
<br>
Thanks,
<br>
- Maura Dailey
<br>
_______________________________________________
<br>
scap-security-guide mailing list
<br>
<a moz-do-not-send="true" class="moz-txt-link-abbreviated"
href="mailto:scap-security-guide@lists.fedorahosted.org">scap-security-guide@lists.fedorahosted.org</a>
<br>
<a moz-do-not-send="true" class="moz-txt-link-freetext"
href="https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide">https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide</a>
<br>
</blockquote>
<br>
Addendum: enforcing=4 has no effect. SELinux is still turned on
and Enforcing.
</blockquote>
Thank you!<br>
<br>
In regards to the ID name & spacing, I'm going into meetings for
the rest of the day. If you're up to it, I'd say push a patch for
these as a bugfix.... OVAL ID should definitely match XCCDF rule id!<br>
</body>
</html>