Note: This bug is displayed in read-only format because
the product is no longer active in Red Hat Bugzilla.
RHEL Engineering is moving the tracking of its product development work on RHEL 6 through RHEL 9 to Red Hat Jira (issues.redhat.com). If you're a Red Hat customer, please continue to file support cases via the Red Hat customer portal. If you're not, please head to the "RHEL project" in Red Hat Jira and file new tickets here. Individual Bugzilla bugs in the statuses "NEW", "ASSIGNED", and "POST" are being migrated throughout September 2023. Bugs of Red Hat partners with an assigned Engineering Partner Manager (EPM) are migrated in late September as per pre-agreed dates. Bugs against components "kernel", "kernel-rt", and "kpatch" are only migrated if still in "NEW" or "ASSIGNED". If you cannot log in to RH Jira, please consult article #7032570. That failing, please send an e-mail to the RH Jira admins at rh-issues@redhat.com to troubleshoot your issue as a user management inquiry. The email creates a ServiceNow ticket with Red Hat. Individual Bugzilla bugs that are migrated will be moved to status "CLOSED", resolution "MIGRATED", and set with "MigratedToJIRA" in "Keywords". The link to the successor Jira issue will be found under "Links", have a little "two-footprint" icon next to it, and direct you to the "RHEL project" in Red Hat Jira (issue links are of type "https://issues.redhat.com/browse/RHEL-XXXX", where "X" is a digit). This same link will be available in a blue banner at the top of the page informing you that that bug has been migrated.
Description of problem:
Upon first installation, /etc/selinux/config contains the following env variable definition:
-------- 8< ---------------- 8< ---------------- 8< ---------------- 8< --------
SELINUXTYPE=targeted
-------- 8< ---------------- 8< ---------------- 8< ---------------- 8< --------
^^^
There is a trailing whitespace, which causes oscap to fail on rule "xccdf_org.ssgproject.content_rule_selinux_policytype":
-------- 8< ---------------- 8< ---------------- 8< ---------------- 8< --------
# oscap xccdf eval --rule xccdf_org.ssgproject.content_rule_selinux_policytype --profile xccdf_org.ssgproject.content_profile_stig /usr/share/xml/scap/ssg/content/ssg-rhel7-ds.xml
[...]
Title Configure SELinux Policy
Rule xccdf_org.ssgproject.content_rule_selinux_policytype
Ident CCE-27279-9
Result fail
-------- 8< ---------------- 8< ---------------- 8< ---------------- 8< --------
The issue is within the spec file, around line 463:
-------- 8< ---------------- 8< ---------------- 8< ---------------- 8< --------
458 SELINUX=enforcing
459 # SELINUXTYPE= can take one of three values:
460 # targeted - Targeted processes are protected,
461 # minimum - Modification of targeted policy. Only selected processes are protected.
462 # mls - Multi Level Security protection.
463 SELINUXTYPE=targeted <<<<< HERE
464
465 " > /etc/selinux/config
-------- 8< ---------------- 8< ---------------- 8< ---------------- 8< --------
I understand this is not much and the issue is within scap-security-guide that has a too strict rule, but please consider this anyway for next policy update:
it's not much and can save customers troubleshooting.
Version-Release number of selected component (if applicable):
latest and before
How reproducible:
Always, see above.
Additional info:
I'll create the corresponding scap-security-guide bug shortly.
This has been fixed for RHEL8 in a06a666c051919f969a85bdc7992aae2e6f19150, the trailing space is not there any longer.
commit a06a666c051919f969a85bdc7992aae2e6f19150
Author: Troy Dawson <tdawson>
Date: Fri Nov 17 19:12:03 2017 +0000
...
@@ -464,7 +462,7 @@ SELINUX=enforcing
# targeted - Targeted processes are protected,
# minimum - Modification of targeted policy. Only selected processes are protected.
# mls - Multi Level Security protection.
-SELINUXTYPE=targeted
+SELINUXTYPE=targeted
" > /etc/selinux/config
...
Description of problem: Upon first installation, /etc/selinux/config contains the following env variable definition: -------- 8< ---------------- 8< ---------------- 8< ---------------- 8< -------- SELINUXTYPE=targeted -------- 8< ---------------- 8< ---------------- 8< ---------------- 8< -------- ^^^ There is a trailing whitespace, which causes oscap to fail on rule "xccdf_org.ssgproject.content_rule_selinux_policytype": -------- 8< ---------------- 8< ---------------- 8< ---------------- 8< -------- # oscap xccdf eval --rule xccdf_org.ssgproject.content_rule_selinux_policytype --profile xccdf_org.ssgproject.content_profile_stig /usr/share/xml/scap/ssg/content/ssg-rhel7-ds.xml [...] Title Configure SELinux Policy Rule xccdf_org.ssgproject.content_rule_selinux_policytype Ident CCE-27279-9 Result fail -------- 8< ---------------- 8< ---------------- 8< ---------------- 8< -------- The issue is within the spec file, around line 463: -------- 8< ---------------- 8< ---------------- 8< ---------------- 8< -------- 458 SELINUX=enforcing 459 # SELINUXTYPE= can take one of three values: 460 # targeted - Targeted processes are protected, 461 # minimum - Modification of targeted policy. Only selected processes are protected. 462 # mls - Multi Level Security protection. 463 SELINUXTYPE=targeted <<<<< HERE 464 465 " > /etc/selinux/config -------- 8< ---------------- 8< ---------------- 8< ---------------- 8< -------- I understand this is not much and the issue is within scap-security-guide that has a too strict rule, but please consider this anyway for next policy update: it's not much and can save customers troubleshooting. Version-Release number of selected component (if applicable): latest and before How reproducible: Always, see above. Additional info: I'll create the corresponding scap-security-guide bug shortly.