From 82c99e8de8f2ffef7d340fd7c1d9088367650eb5 Mon Sep 17 00:00:00 2001

From: Watson Sato <wsato@redhat.com>

Date: Mon, 10 May 2021 18:53:02 +0200

Subject: [PATCH]  Update and select seboolean rules for R67

Fix description of sebool_deny_execmem, and warning about possible

issues.

Add rationale to rules the SELinux booleans.

---

 controls/anssi.yml                            | 14 +++++++++---

 .../sebool_deny_execmem/rule.yml              | 22 ++++++++++++++-----

 .../sebool_selinuxuser_execheap/rule.yml      |  4 +++-

 .../sebool_selinuxuser_execstack/rule.yml     |  3 ++-

 4 files changed, 33 insertions(+), 10 deletions(-)

diff --git a/controls/anssi.yml b/controls/anssi.yml

index 705f8e25aab..ef9356a6fea 100644

--- a/controls/anssi.yml

+++ b/controls/anssi.yml

@@ -967,10 +967,18 @@ controls:

       allow_execstack to off, forbids processes to make their stack executable;

       secure_mode_insmod to on, prohibits dynamic loading of modules by any process;

       ssh_sysadm_login to off, forbids SSH logins to connect directly in sysadmin role.

+    notes:

+      In RHEL, the SELinux boolean allow_execheap is renamed to selinuxuser_execheap, and the

+      boolean allow_execstack is renamed to selinuxuser_execstack. And allow_execmem is not

+      available, deny_execmem provides the same functionality.

+    automated: yes

     rules:

-    # Add rule for sebool allow_execheap

-    # Add rule for sebool allow_execmem

-    # Add rule for sebool allow_execstack

+    - var_selinuxuser_execheap=off

+    - sebool_selinuxuser_execheap

+    - var_deny_execmem=on

+    - sebool_deny_execmem

+    - var_selinuxuser_execstack=off

+    - sebool_selinuxuser_execstack

     - var_secure_mode_insmod=on

     - sebool_secure_mode_insmod

     - sebool_ssh_sysadm_login

diff --git a/linux_os/guide/system/selinux/selinux-booleans/sebool_deny_execmem/rule.yml b/linux_os/guide/system/selinux/selinux-booleans/sebool_deny_execmem/rule.yml

index f340ea4be11..e8453fbfb8d 100644

--- a/linux_os/guide/system/selinux/selinux-booleans/sebool_deny_execmem/rule.yml

+++ b/linux_os/guide/system/selinux/selinux-booleans/sebool_deny_execmem/rule.yml

@@ -2,14 +2,16 @@ documentation_complete: true

 prodtype: rhel7,rhel8,rhel9,rhv4

-title: 'Disable the deny_execmem SELinux Boolean'

+title: 'Enable the deny_execmem SELinux Boolean'

 description: |-

     By default, the SELinux boolean <tt>deny_execmem</tt> is disabled.

-    If this setting is enabled, it should be disabled.

+    If this setting is disabled, it should be enabled.

     {{{ describe_sebool_disable(sebool="deny_execmem") }}}

-rationale: ""

+rationale: |-

+    Allowing user domain applications to map a memory region as both writable and

+    executable makes them more susceptible to data execution attacks.

 severity: medium

@@ -19,10 +21,20 @@ identifiers:

 references:

     anssi: BP28(R67)

-    

-{{{ complete_ocil_entry_sebool_disabled(sebool="deny_execmem") }}}

+

+{{{ complete_ocil_entry_sebool_enabled(sebool="deny_execmem") }}}

+

+warnings:

+    - general: |-

+        This rule doesn't come with a remediation, as enabling this SELinux boolean can cause

+        applications to malfunction, for example Graphical login managers and Firefox.

+    - functionality: |-

+        Proper function and stability should be assessed before applying enabling the SELinux boolean in production systems.

 template:

     name: sebool

     vars:

         seboolid: deny_execmem

+    backends:

+        bash: "off"

+        ansible: "off"

diff --git a/linux_os/guide/system/selinux/selinux-booleans/sebool_selinuxuser_execheap/rule.yml b/linux_os/guide/system/selinux/selinux-booleans/sebool_selinuxuser_execheap/rule.yml

index 45aa81a1223..7fedaab6130 100644

--- a/linux_os/guide/system/selinux/selinux-booleans/sebool_selinuxuser_execheap/rule.yml

+++ b/linux_os/guide/system/selinux/selinux-booleans/sebool_selinuxuser_execheap/rule.yml

@@ -6,10 +6,12 @@ title: 'Disable the selinuxuser_execheap SELinux Boolean'

 description: |-

     By default, the SELinux boolean <tt>selinuxuser_execheap</tt> is disabled.

+    When enabled this boolean is enabled it allows selinuxusers to execute code from the heap.

     If this setting is enabled, it should be disabled.

     {{{ describe_sebool_disable(sebool="selinuxuser_execheap") }}}

-rationale: ""

+rationale: |-

+    Disabling code execution from the heap blocks buffer overflow attacks.

 severity: medium

diff --git a/linux_os/guide/system/selinux/selinux-booleans/sebool_selinuxuser_execstack/rule.yml b/linux_os/guide/system/selinux/selinux-booleans/sebool_selinuxuser_execstack/rule.yml

index 2b20d0bfe4f..2e0b19f881d 100644

--- a/linux_os/guide/system/selinux/selinux-booleans/sebool_selinuxuser_execstack/rule.yml

+++ b/linux_os/guide/system/selinux/selinux-booleans/sebool_selinuxuser_execstack/rule.yml

@@ -10,7 +10,8 @@ description: |-

     to make their stack executable.

     {{{ describe_sebool_disable(sebool="selinuxuser_execstack") }}}

-rationale: ""

+rationale: |-

+    Disabling code execution from the stack blocks buffer overflow attacks.

 severity: medium