<html>
  <head>
    <meta content="text/html; charset=UTF-8" http-equiv="Content-Type">
  </head>
  <body bgcolor="#FFFFFF" text="#000000">
    <div class="moz-cite-prefix">Shawn, <br>
      <br>
      If these files exist and contain '1':<br>
      <br>
          '/selinux/enforce' - RHEL 6<br>
          '/sys/fs/selinux/enforce' - Fedora 19<br>
      <br>
      Then SELinux is enabled and enforcing - the filesystem can only
      exist if SELinux is enabled, the contents are the enforcement
      status.<br>
      <br>
      -Frank<br>
      <br>
      <br>
      On 10/04/2013 11:04 PM, Shawn Wells wrote:<br>
    </div>
    <blockquote cite="mid:524F81A0.6030005@redhat.com" type="cite">
      <meta content="text/html; charset=UTF-8" http-equiv="Content-Type">
      <div class="moz-cite-prefix">On 10/4/13 2:55 PM, <a
          moz-do-not-send="true" class="moz-txt-link-abbreviated"
          href="mailto:fcaviggi@redhat.com">fcaviggi@redhat.com</a>
        wrote:<br>
      </div>
      <blockquote cite="mid:524F0F28.2070204@redhat.com" type="cite">
        <meta content="text/html; charset=UTF-8"
          http-equiv="Content-Type">
        <div class="moz-cite-prefix">Jan,<br>
          <br>
          Doh. The '/selinux/enforce' was RHEL 6 - for Fedora 19 - it's
          '/sys/fs/selinux/enforce'<br>
          <br>
          -Frank<br>
          <br>
          <br>
          On 10/04/2013 02:49 PM, <a moz-do-not-send="true"
            class="moz-txt-link-abbreviated"
            href="mailto:fcaviggi@redhat.com">fcaviggi@redhat.com</a>
          wrote:<br>
        </div>
        <blockquote cite="mid:524F0DBC.8010704@redhat.com" type="cite">
          <meta content="text/html; charset=UTF-8"
            http-equiv="Content-Type">
          <div class="moz-cite-prefix">Jan,<br>
            <br>
            You might consider checking if the '/selinux/enforce' file
            exists and the file contains '1' (1 is enforcing). That
            would ensure that SELinux enabled and enforcing the policy.<br>
            <br>
            Regards,<br>
            <br>
            Frank Caviggia<br>
            <br>
            <br>
            On 10/04/2013 01:11 PM, Jan Lieskovsky wrote:<br>
          </div>
          <blockquote
            cite="mid:330874596.1539148.1380906669499.JavaMail.root@redhat.com"
            type="cite">
            <pre wrap="">Introduce new SELinux section of the guide and first rule
for it - check if SELinux is enabled in currently
booted kernel.

Please review.

Thank you &amp;&amp; Regards, Jan.
--
Jan iankko Lieskovsky / Red Hat Security Technologies Team</pre>
            <br>
          </blockquote>
        </blockquote>
      </blockquote>
      <br>
      Within the OVAL:<br>
      <br>
      +  &lt;ind:textfilecontent54_test check="all"
      check_existence="only_one_exists" comment="check for existence of
      selinuxfs in /proc/mounts file"
      id="test_ensure_selinuxfs_in_proc_mounts" version="1" &gt;<br>
      +    &lt;ind:object
      object_ref="obj_ensure_selinuxfs_in_proc_mounts" /&gt;<br>
      +  &lt;/ind:textfilecontent54_test&gt;<br>
      +  &lt;ind:textfilecontent54_object
      id="obj_ensure_selinuxfs_in_proc_mounts" version="1"&gt;<br>
      +    &lt;ind:filepath&gt;/proc/mounts&lt;/ind:filepath&gt;<br>
      +    &lt;ind:pattern operation="pattern
match"&gt;^\s*selinuxfs\s*/sys/fs/selinux\s*selinuxfs\s*rw,relatime\s*0\s*0\s*$&lt;/ind:pattern&gt;<br>
      +    &lt;ind:instance datatype="int"
      operation="equals"&gt;1&lt;/ind:instance&gt;<br>
      +  &lt;/ind:textfilecontent54_object&gt;<br>
      <br>
      <br>
      Caviggia and I were chatting earlier today.... while the
      /proc/mounts reflects that selinux is loaded into the kernel,
      IIRC, it doesn't indicate that it's actually *enforcing* on the
      system. This poses an interesting challenge...<br>
      <br>
      Within the RHEL6 content, we:<br>
      - Check for selinux=1 within grub<br>
      - Check for SELINUX=enforcing within /etc/selinux/config<br>
      <br>
      These checks do not reflect *runtime* enablement of SELinux, but
      unfortunately neither does /proc/mounts:<br>
      <blockquote type="cite">[shawn@SSG-RHEL6 checks]$ getenforce <br>
        Enforcing<br>
        <br>
        [shawn@SSG-RHEL6 checks]$ cat /proc/mounts | grep selinux<br>
        none /selinux selinuxfs rw,relatime 0 0<br>
        <br>
        [shawn@SSG-RHEL6 checks]$ sudo setenforce 0<br>
        [sudo] password for shawn: <br>
        <br>
        [shawn@SSG-RHEL6 checks]$ cat /proc/mounts | grep selinux<br>
        none /selinux selinuxfs rw,relatime 0 0</blockquote>
      Is there another crafty way to verify that selinux is *enforcing*?
      Perhaps checking the value in /etc/selinux instead?<br>
      <blockquote type="cite">[shawn@SSG-RHEL6 self]$ cat
        /selinux/enforce <br>
        1<br>
        [shawn@SSG-RHEL6 self]$ sudo setenforce 0<br>
        <br>
        [shawn@SSG-RHEL6 self]$ cat /selinux/enforce <br>
        0</blockquote>
      If that's a non-reputable source of SELinux enablement, we should
      add an appropriate XCCDF and OVAL rule to Fedora &amp; RHEL
      streams.<br>
      <br>
      <fieldset class="mimeAttachmentHeader"></fieldset>
      <br>
      <pre wrap="">_______________________________________________
scap-security-guide mailing list
<a class="moz-txt-link-abbreviated" href="mailto:scap-security-guide@lists.fedorahosted.org">scap-security-guide@lists.fedorahosted.org</a>
<a class="moz-txt-link-freetext" href="https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide">https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide</a>
</pre>
    </blockquote>
    <br>
    <br>
    <pre class="moz-signature" cols="72">-- 
Frank Caviggia
Consultant, Public Sector
<a class="moz-txt-link-abbreviated" href="mailto:fcaviggi@redhat.com">fcaviggi@redhat.com</a>
(M) (571) 295-4560</pre>
  </body>
</html>