scap-security-guide/SOURCES/scap-security-guide-0.1.57-select_seboolean_rules_for_ANSSI-PR_6988.patch

121 lines
5.0 KiB
Diff
Raw Normal View History

From 82c99e8de8f2ffef7d340fd7c1d9088367650eb5 Mon Sep 17 00:00:00 2001
From: Watson Sato <wsato@redhat.com>
Date: Mon, 10 May 2021 18:53:02 +0200
Subject: [PATCH] Update and select seboolean rules for R67
Fix description of sebool_deny_execmem, and warning about possible
issues.
Add rationale to rules the SELinux booleans.
---
controls/anssi.yml | 14 +++++++++---
.../sebool_deny_execmem/rule.yml | 22 ++++++++++++++-----
.../sebool_selinuxuser_execheap/rule.yml | 4 +++-
.../sebool_selinuxuser_execstack/rule.yml | 3 ++-
4 files changed, 33 insertions(+), 10 deletions(-)
diff --git a/controls/anssi.yml b/controls/anssi.yml
index 705f8e25aab..ef9356a6fea 100644
--- a/controls/anssi.yml
+++ b/controls/anssi.yml
@@ -967,10 +967,18 @@ controls:
allow_execstack to off, forbids processes to make their stack executable;
secure_mode_insmod to on, prohibits dynamic loading of modules by any process;
ssh_sysadm_login to off, forbids SSH logins to connect directly in sysadmin role.
+ notes:
+ In RHEL, the SELinux boolean allow_execheap is renamed to selinuxuser_execheap, and the
+ boolean allow_execstack is renamed to selinuxuser_execstack. And allow_execmem is not
+ available, deny_execmem provides the same functionality.
+ automated: yes
rules:
- # Add rule for sebool allow_execheap
- # Add rule for sebool allow_execmem
- # Add rule for sebool allow_execstack
+ - var_selinuxuser_execheap=off
+ - sebool_selinuxuser_execheap
+ - var_deny_execmem=on
+ - sebool_deny_execmem
+ - var_selinuxuser_execstack=off
+ - sebool_selinuxuser_execstack
- var_secure_mode_insmod=on
- sebool_secure_mode_insmod
- sebool_ssh_sysadm_login
diff --git a/linux_os/guide/system/selinux/selinux-booleans/sebool_deny_execmem/rule.yml b/linux_os/guide/system/selinux/selinux-booleans/sebool_deny_execmem/rule.yml
index f340ea4be11..e8453fbfb8d 100644
--- a/linux_os/guide/system/selinux/selinux-booleans/sebool_deny_execmem/rule.yml
+++ b/linux_os/guide/system/selinux/selinux-booleans/sebool_deny_execmem/rule.yml
@@ -2,14 +2,16 @@ documentation_complete: true
prodtype: rhel7,rhel8,rhel9,rhv4
-title: 'Disable the deny_execmem SELinux Boolean'
+title: 'Enable the deny_execmem SELinux Boolean'
description: |-
By default, the SELinux boolean <tt>deny_execmem</tt> is disabled.
- If this setting is enabled, it should be disabled.
+ If this setting is disabled, it should be enabled.
{{{ describe_sebool_disable(sebool="deny_execmem") }}}
-rationale: ""
+rationale: |-
+ Allowing user domain applications to map a memory region as both writable and
+ executable makes them more susceptible to data execution attacks.
severity: medium
@@ -19,10 +21,20 @@ identifiers:
references:
anssi: BP28(R67)
-
-{{{ complete_ocil_entry_sebool_disabled(sebool="deny_execmem") }}}
+
+{{{ complete_ocil_entry_sebool_enabled(sebool="deny_execmem") }}}
+
+warnings:
+ - general: |-
+ This rule doesn't come with a remediation, as enabling this SELinux boolean can cause
+ applications to malfunction, for example Graphical login managers and Firefox.
+ - functionality: |-
+ Proper function and stability should be assessed before applying enabling the SELinux boolean in production systems.
template:
name: sebool
vars:
seboolid: deny_execmem
+ backends:
+ bash: "off"
+ ansible: "off"
diff --git a/linux_os/guide/system/selinux/selinux-booleans/sebool_selinuxuser_execheap/rule.yml b/linux_os/guide/system/selinux/selinux-booleans/sebool_selinuxuser_execheap/rule.yml
index 45aa81a1223..7fedaab6130 100644
--- a/linux_os/guide/system/selinux/selinux-booleans/sebool_selinuxuser_execheap/rule.yml
+++ b/linux_os/guide/system/selinux/selinux-booleans/sebool_selinuxuser_execheap/rule.yml
@@ -6,10 +6,12 @@ title: 'Disable the selinuxuser_execheap SELinux Boolean'
description: |-
By default, the SELinux boolean <tt>selinuxuser_execheap</tt> is disabled.
+ When enabled this boolean is enabled it allows selinuxusers to execute code from the heap.
If this setting is enabled, it should be disabled.
{{{ describe_sebool_disable(sebool="selinuxuser_execheap") }}}
-rationale: ""
+rationale: |-
+ Disabling code execution from the heap blocks buffer overflow attacks.
severity: medium
diff --git a/linux_os/guide/system/selinux/selinux-booleans/sebool_selinuxuser_execstack/rule.yml b/linux_os/guide/system/selinux/selinux-booleans/sebool_selinuxuser_execstack/rule.yml
index 2b20d0bfe4f..2e0b19f881d 100644
--- a/linux_os/guide/system/selinux/selinux-booleans/sebool_selinuxuser_execstack/rule.yml
+++ b/linux_os/guide/system/selinux/selinux-booleans/sebool_selinuxuser_execstack/rule.yml
@@ -10,7 +10,8 @@ description: |-
to make their stack executable.
{{{ describe_sebool_disable(sebool="selinuxuser_execstack") }}}
-rationale: ""
+rationale: |-
+ Disabling code execution from the stack blocks buffer overflow attacks.
severity: medium