|
 |
2b7b16 |
--- scap-security-guide-0.1.19/RHEL/7/input/system/selinux.xml.orig 2014-09-29 06:19:27.427097200 -0400
|
|
|
2b7b16 |
+++ scap-security-guide-0.1.19/RHEL/7/input/system/selinux.xml 2014-09-29 06:20:14.703998808 -0400
|
|
|
2b7b16 |
@@ -117,23 +117,6 @@ targeted for exploitation, such as netwo
|
|
|
2b7b16 |
<tested by="DS" on="20121024"/>
|
|
|
2b7b16 |
</Rule>
|
|
|
2b7b16 |
|
|
|
2b7b16 |
-<Rule id="service_restorecond_enabled">
|
|
|
2b7b16 |
-<title>Enable the SELinux Context Restoration Service (restorecond)</title>
|
|
|
2b7b16 |
-<description>The <tt>restorecond</tt> service utilizes <tt>inotify</tt> to look
|
|
|
2b7b16 |
-for the creation of new files listed in the
|
|
|
2b7b16 |
-<tt>/etc/selinux/restorecond.conf</tt> configuration file. When a file is
|
|
|
2b7b16 |
-created, <tt>restorecond</tt> ensures the file receives the proper SELinux
|
|
|
2b7b16 |
-security context.
|
|
|
2b7b16 |
-<service-enable-macro service="restorecond" />
|
|
|
2b7b16 |
-</description>
|
|
|
2b7b16 |
-<rationale>The <tt>restorecond</tt> service helps ensure that the default SELinux
|
|
|
2b7b16 |
-file context is applied to files. This allows automatic correction
|
|
|
2b7b16 |
-of file contexts created by some programs.</rationale>
|
|
|
2b7b16 |
-<ident cce="RHEL7-CCE-TBD" />
|
|
|
2b7b16 |
-<oval id="service_restorecond_enabled" />
|
|
|
2b7b16 |
-<ref nist="AC-3,AC-3(3),AC-4,AC-6,AU-9" />
|
|
|
2b7b16 |
-</Rule>
|
|
|
2b7b16 |
-
|
|
|
2b7b16 |
<Rule id="package_setroubleshoot_removed">
|
|
|
2b7b16 |
<title>Uninstall setroubleshoot Package</title>
|
|
|
2b7b16 |
<description>The SETroubleshoot service notifies desktop users of SELinux
|
|
|
2b7b16 |
--- scap-security-guide-0.1.19/RHEL/7/input/fixes/bash/service_restorecond_enabled.sh 2014-09-28 07:55:58.000000000 -0400
|
|
|
2b7b16 |
+++ /dev/null 2014-09-29 05:45:02.862000000 -0400
|
|
|
2b7b16 |
@@ -1,9 +0,0 @@
|
|
|
2b7b16 |
-#
|
|
|
2b7b16 |
-# Enable restorecond.service for all systemd targets
|
|
|
2b7b16 |
-#
|
|
|
2b7b16 |
-systemctl enable restorecond.service
|
|
|
2b7b16 |
-
|
|
|
2b7b16 |
-#
|
|
|
2b7b16 |
-# Start restorecond.service if not currently running
|
|
|
2b7b16 |
-#
|
|
|
2b7b16 |
-systemctl start restorecond.service
|