<html>
  <head>
    <meta content="text/html; charset=UTF-8" http-equiv="Content-Type">
  </head>
  <body bgcolor="#FFFFFF" text="#000000">
    <div class="moz-cite-prefix">On 10/4/13 2:55 PM, <a class="moz-txt-link-abbreviated" href="mailto:fcaviggi@redhat.com">fcaviggi@redhat.com</a>
      wrote:<br>
    </div>
    <blockquote cite="mid:524F0F28.2070204@redhat.com" type="cite">
      <meta content="text/html; charset=UTF-8" http-equiv="Content-Type">
      <div class="moz-cite-prefix">Jan,<br>
        <br>
        Doh. The '/selinux/enforce' was RHEL 6 - for Fedora 19 - it's
        '/sys/fs/selinux/enforce'<br>
        <br>
        -Frank<br>
        <br>
        <br>
        On 10/04/2013 02:49 PM, <a moz-do-not-send="true"
          class="moz-txt-link-abbreviated"
          href="mailto:fcaviggi@redhat.com">fcaviggi@redhat.com</a>
        wrote:<br>
      </div>
      <blockquote cite="mid:524F0DBC.8010704@redhat.com" type="cite">
        <meta content="text/html; charset=UTF-8"
          http-equiv="Content-Type">
        <div class="moz-cite-prefix">Jan,<br>
          <br>
          You might consider checking if the '/selinux/enforce' file
          exists and the file contains '1' (1 is enforcing). That would
          ensure that SELinux enabled and enforcing the policy.<br>
          <br>
          Regards,<br>
          <br>
          Frank Caviggia<br>
          <br>
          <br>
          On 10/04/2013 01:11 PM, Jan Lieskovsky wrote:<br>
        </div>
        <blockquote
          cite="mid:330874596.1539148.1380906669499.JavaMail.root@redhat.com"
          type="cite">
          <pre wrap="">Introduce new SELinux section of the guide and first rule
for it - check if SELinux is enabled in currently
booted kernel.

Please review.

Thank you &amp;&amp; Regards, Jan.
--
Jan iankko Lieskovsky / Red Hat Security Technologies Team</pre>
          <br>
        </blockquote>
      </blockquote>
    </blockquote>
    <br>
    Within the OVAL:<br>
    <br>
    +  &lt;ind:textfilecontent54_test check="all"
    check_existence="only_one_exists" comment="check for existence of
    selinuxfs in /proc/mounts file"
    id="test_ensure_selinuxfs_in_proc_mounts" version="1" &gt;<br>
    +    &lt;ind:object object_ref="obj_ensure_selinuxfs_in_proc_mounts"
    /&gt;<br>
    +  &lt;/ind:textfilecontent54_test&gt;<br>
    +  &lt;ind:textfilecontent54_object
    id="obj_ensure_selinuxfs_in_proc_mounts" version="1"&gt;<br>
    +    &lt;ind:filepath&gt;/proc/mounts&lt;/ind:filepath&gt;<br>
    +    &lt;ind:pattern operation="pattern
match"&gt;^\s*selinuxfs\s*/sys/fs/selinux\s*selinuxfs\s*rw,relatime\s*0\s*0\s*$&lt;/ind:pattern&gt;<br>
    +    &lt;ind:instance datatype="int"
    operation="equals"&gt;1&lt;/ind:instance&gt;<br>
    +  &lt;/ind:textfilecontent54_object&gt;<br>
    <br>
    <br>
    Caviggia and I were chatting earlier today.... while the
    /proc/mounts reflects that selinux is loaded into the kernel, IIRC,
    it doesn't indicate that it's actually *enforcing* on the system.
    This poses an interesting challenge...<br>
    <br>
    Within the RHEL6 content, we:<br>
    - Check for selinux=1 within grub<br>
    - Check for SELINUX=enforcing within /etc/selinux/config<br>
    <br>
    These checks do not reflect *runtime* enablement of SELinux, but
    unfortunately neither does /proc/mounts:<br>
    <blockquote type="cite">[shawn@SSG-RHEL6 checks]$ getenforce <br>
      Enforcing<br>
      <br>
      [shawn@SSG-RHEL6 checks]$ cat /proc/mounts | grep selinux<br>
      none /selinux selinuxfs rw,relatime 0 0<br>
      <br>
      [shawn@SSG-RHEL6 checks]$ sudo setenforce 0<br>
      [sudo] password for shawn: <br>
      <br>
      [shawn@SSG-RHEL6 checks]$ cat /proc/mounts | grep selinux<br>
      none /selinux selinuxfs rw,relatime 0 0</blockquote>
    Is there another crafty way to verify that selinux is *enforcing*?
    Perhaps checking the value in /etc/selinux instead?<br>
    <blockquote type="cite">[shawn@SSG-RHEL6 self]$ cat /selinux/enforce
      <br>
      1<br>
      [shawn@SSG-RHEL6 self]$ sudo setenforce 0<br>
      <br>
      [shawn@SSG-RHEL6 self]$ cat /selinux/enforce <br>
      0</blockquote>
    If that's a non-reputable source of SELinux enablement, we should
    add an appropriate XCCDF and OVAL rule to Fedora &amp; RHEL streams.<br>
  </body>
</html>