<html>
<head>
<meta content="text/html; charset=UTF-8" http-equiv="Content-Type">
</head>
<body bgcolor="#FFFFFF" text="#000000">
<div class="moz-cite-prefix">Shawn, <br>
<br>
If these files exist and contain '1':<br>
<br>
'/selinux/enforce' - RHEL 6<br>
'/sys/fs/selinux/enforce' - Fedora 19<br>
<br>
Then SELinux is enabled and enforcing - the filesystem can only
exist if SELinux is enabled, the contents are the enforcement
status.<br>
<br>
-Frank<br>
<br>
<br>
On 10/04/2013 11:04 PM, Shawn Wells wrote:<br>
</div>
<blockquote cite="mid:524F81A0.6030005@redhat.com" type="cite">
<meta content="text/html; charset=UTF-8" http-equiv="Content-Type">
<div class="moz-cite-prefix">On 10/4/13 2:55 PM, <a
moz-do-not-send="true" class="moz-txt-link-abbreviated"
href="mailto:fcaviggi@redhat.com">fcaviggi@redhat.com</a>
wrote:<br>
</div>
<blockquote cite="mid:524F0F28.2070204@redhat.com" type="cite">
<meta content="text/html; charset=UTF-8"
http-equiv="Content-Type">
<div class="moz-cite-prefix">Jan,<br>
<br>
Doh. The '/selinux/enforce' was RHEL 6 - for Fedora 19 - it's
'/sys/fs/selinux/enforce'<br>
<br>
-Frank<br>
<br>
<br>
On 10/04/2013 02:49 PM, <a moz-do-not-send="true"
class="moz-txt-link-abbreviated"
href="mailto:fcaviggi@redhat.com">fcaviggi@redhat.com</a>
wrote:<br>
</div>
<blockquote cite="mid:524F0DBC.8010704@redhat.com" type="cite">
<meta content="text/html; charset=UTF-8"
http-equiv="Content-Type">
<div class="moz-cite-prefix">Jan,<br>
<br>
You might consider checking if the '/selinux/enforce' file
exists and the file contains '1' (1 is enforcing). That
would ensure that SELinux enabled and enforcing the policy.<br>
<br>
Regards,<br>
<br>
Frank Caviggia<br>
<br>
<br>
On 10/04/2013 01:11 PM, Jan Lieskovsky wrote:<br>
</div>
<blockquote
cite="mid:330874596.1539148.1380906669499.JavaMail.root@redhat.com"
type="cite">
<pre wrap="">Introduce new SELinux section of the guide and first rule
for it - check if SELinux is enabled in currently
booted kernel.
Please review.
Thank you && Regards, Jan.
--
Jan iankko Lieskovsky / Red Hat Security Technologies Team</pre>
<br>
</blockquote>
</blockquote>
</blockquote>
<br>
Within the OVAL:<br>
<br>
+ <ind:textfilecontent54_test check="all"
check_existence="only_one_exists" comment="check for existence of
selinuxfs in /proc/mounts file"
id="test_ensure_selinuxfs_in_proc_mounts" version="1" ><br>
+ <ind:object
object_ref="obj_ensure_selinuxfs_in_proc_mounts" /><br>
+ </ind:textfilecontent54_test><br>
+ <ind:textfilecontent54_object
id="obj_ensure_selinuxfs_in_proc_mounts" version="1"><br>
+ <ind:filepath>/proc/mounts</ind:filepath><br>
+ <ind:pattern operation="pattern
match">^\s*selinuxfs\s*/sys/fs/selinux\s*selinuxfs\s*rw,relatime\s*0\s*0\s*$</ind:pattern><br>
+ <ind:instance datatype="int"
operation="equals">1</ind:instance><br>
+ </ind:textfilecontent54_object><br>
<br>
<br>
Caviggia and I were chatting earlier today.... while the
/proc/mounts reflects that selinux is loaded into the kernel,
IIRC, it doesn't indicate that it's actually *enforcing* on the
system. This poses an interesting challenge...<br>
<br>
Within the RHEL6 content, we:<br>
- Check for selinux=1 within grub<br>
- Check for SELINUX=enforcing within /etc/selinux/config<br>
<br>
These checks do not reflect *runtime* enablement of SELinux, but
unfortunately neither does /proc/mounts:<br>
<blockquote type="cite">[shawn@SSG-RHEL6 checks]$ getenforce <br>
Enforcing<br>
<br>
[shawn@SSG-RHEL6 checks]$ cat /proc/mounts | grep selinux<br>
none /selinux selinuxfs rw,relatime 0 0<br>
<br>
[shawn@SSG-RHEL6 checks]$ sudo setenforce 0<br>
[sudo] password for shawn: <br>
<br>
[shawn@SSG-RHEL6 checks]$ cat /proc/mounts | grep selinux<br>
none /selinux selinuxfs rw,relatime 0 0</blockquote>
Is there another crafty way to verify that selinux is *enforcing*?
Perhaps checking the value in /etc/selinux instead?<br>
<blockquote type="cite">[shawn@SSG-RHEL6 self]$ cat
/selinux/enforce <br>
1<br>
[shawn@SSG-RHEL6 self]$ sudo setenforce 0<br>
<br>
[shawn@SSG-RHEL6 self]$ cat /selinux/enforce <br>
0</blockquote>
If that's a non-reputable source of SELinux enablement, we should
add an appropriate XCCDF and OVAL rule to Fedora & RHEL
streams.<br>
<br>
<fieldset class="mimeAttachmentHeader"></fieldset>
<br>
<pre wrap="">_______________________________________________
scap-security-guide mailing list
<a class="moz-txt-link-abbreviated" href="mailto:scap-security-guide@lists.fedorahosted.org">scap-security-guide@lists.fedorahosted.org</a>
<a class="moz-txt-link-freetext" href="https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide">https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide</a>
</pre>
</blockquote>
<br>
<br>
<pre class="moz-signature" cols="72">--
Frank Caviggia
Consultant, Public Sector
<a class="moz-txt-link-abbreviated" href="mailto:fcaviggi@redhat.com">fcaviggi@redhat.com</a>
(M) (571) 295-4560</pre>
</body>
</html>