121 lines
5.0 KiB
Diff
121 lines
5.0 KiB
Diff
From 82c99e8de8f2ffef7d340fd7c1d9088367650eb5 Mon Sep 17 00:00:00 2001
|
|
From: Watson Sato <wsato@redhat.com>
|
|
Date: Mon, 10 May 2021 18:53:02 +0200
|
|
Subject: [PATCH] Update and select seboolean rules for R67
|
|
|
|
Fix description of sebool_deny_execmem, and warning about possible
|
|
issues.
|
|
Add rationale to rules the SELinux booleans.
|
|
---
|
|
controls/anssi.yml | 14 +++++++++---
|
|
.../sebool_deny_execmem/rule.yml | 22 ++++++++++++++-----
|
|
.../sebool_selinuxuser_execheap/rule.yml | 4 +++-
|
|
.../sebool_selinuxuser_execstack/rule.yml | 3 ++-
|
|
4 files changed, 33 insertions(+), 10 deletions(-)
|
|
|
|
diff --git a/controls/anssi.yml b/controls/anssi.yml
|
|
index 705f8e25aab..ef9356a6fea 100644
|
|
--- a/controls/anssi.yml
|
|
+++ b/controls/anssi.yml
|
|
@@ -967,10 +967,18 @@ controls:
|
|
allow_execstack to off, forbids processes to make their stack executable;
|
|
secure_mode_insmod to on, prohibits dynamic loading of modules by any process;
|
|
ssh_sysadm_login to off, forbids SSH logins to connect directly in sysadmin role.
|
|
+ notes:
|
|
+ In RHEL, the SELinux boolean allow_execheap is renamed to selinuxuser_execheap, and the
|
|
+ boolean allow_execstack is renamed to selinuxuser_execstack. And allow_execmem is not
|
|
+ available, deny_execmem provides the same functionality.
|
|
+ automated: yes
|
|
rules:
|
|
- # Add rule for sebool allow_execheap
|
|
- # Add rule for sebool allow_execmem
|
|
- # Add rule for sebool allow_execstack
|
|
+ - var_selinuxuser_execheap=off
|
|
+ - sebool_selinuxuser_execheap
|
|
+ - var_deny_execmem=on
|
|
+ - sebool_deny_execmem
|
|
+ - var_selinuxuser_execstack=off
|
|
+ - sebool_selinuxuser_execstack
|
|
- var_secure_mode_insmod=on
|
|
- sebool_secure_mode_insmod
|
|
- sebool_ssh_sysadm_login
|
|
diff --git a/linux_os/guide/system/selinux/selinux-booleans/sebool_deny_execmem/rule.yml b/linux_os/guide/system/selinux/selinux-booleans/sebool_deny_execmem/rule.yml
|
|
index f340ea4be11..e8453fbfb8d 100644
|
|
--- a/linux_os/guide/system/selinux/selinux-booleans/sebool_deny_execmem/rule.yml
|
|
+++ b/linux_os/guide/system/selinux/selinux-booleans/sebool_deny_execmem/rule.yml
|
|
@@ -2,14 +2,16 @@ documentation_complete: true
|
|
|
|
prodtype: rhel7,rhel8,rhel9,rhv4
|
|
|
|
-title: 'Disable the deny_execmem SELinux Boolean'
|
|
+title: 'Enable the deny_execmem SELinux Boolean'
|
|
|
|
description: |-
|
|
By default, the SELinux boolean <tt>deny_execmem</tt> is disabled.
|
|
- If this setting is enabled, it should be disabled.
|
|
+ If this setting is disabled, it should be enabled.
|
|
{{{ describe_sebool_disable(sebool="deny_execmem") }}}
|
|
|
|
-rationale: ""
|
|
+rationale: |-
|
|
+ Allowing user domain applications to map a memory region as both writable and
|
|
+ executable makes them more susceptible to data execution attacks.
|
|
|
|
severity: medium
|
|
|
|
@@ -19,10 +21,20 @@ identifiers:
|
|
|
|
references:
|
|
anssi: BP28(R67)
|
|
-
|
|
-{{{ complete_ocil_entry_sebool_disabled(sebool="deny_execmem") }}}
|
|
+
|
|
+{{{ complete_ocil_entry_sebool_enabled(sebool="deny_execmem") }}}
|
|
+
|
|
+warnings:
|
|
+ - general: |-
|
|
+ This rule doesn't come with a remediation, as enabling this SELinux boolean can cause
|
|
+ applications to malfunction, for example Graphical login managers and Firefox.
|
|
+ - functionality: |-
|
|
+ Proper function and stability should be assessed before applying enabling the SELinux boolean in production systems.
|
|
|
|
template:
|
|
name: sebool
|
|
vars:
|
|
seboolid: deny_execmem
|
|
+ backends:
|
|
+ bash: "off"
|
|
+ ansible: "off"
|
|
diff --git a/linux_os/guide/system/selinux/selinux-booleans/sebool_selinuxuser_execheap/rule.yml b/linux_os/guide/system/selinux/selinux-booleans/sebool_selinuxuser_execheap/rule.yml
|
|
index 45aa81a1223..7fedaab6130 100644
|
|
--- a/linux_os/guide/system/selinux/selinux-booleans/sebool_selinuxuser_execheap/rule.yml
|
|
+++ b/linux_os/guide/system/selinux/selinux-booleans/sebool_selinuxuser_execheap/rule.yml
|
|
@@ -6,10 +6,12 @@ title: 'Disable the selinuxuser_execheap SELinux Boolean'
|
|
|
|
description: |-
|
|
By default, the SELinux boolean <tt>selinuxuser_execheap</tt> is disabled.
|
|
+ When enabled this boolean is enabled it allows selinuxusers to execute code from the heap.
|
|
If this setting is enabled, it should be disabled.
|
|
{{{ describe_sebool_disable(sebool="selinuxuser_execheap") }}}
|
|
|
|
-rationale: ""
|
|
+rationale: |-
|
|
+ Disabling code execution from the heap blocks buffer overflow attacks.
|
|
|
|
severity: medium
|
|
|
|
diff --git a/linux_os/guide/system/selinux/selinux-booleans/sebool_selinuxuser_execstack/rule.yml b/linux_os/guide/system/selinux/selinux-booleans/sebool_selinuxuser_execstack/rule.yml
|
|
index 2b20d0bfe4f..2e0b19f881d 100644
|
|
--- a/linux_os/guide/system/selinux/selinux-booleans/sebool_selinuxuser_execstack/rule.yml
|
|
+++ b/linux_os/guide/system/selinux/selinux-booleans/sebool_selinuxuser_execstack/rule.yml
|
|
@@ -10,7 +10,8 @@ description: |-
|
|
to make their stack executable.
|
|
{{{ describe_sebool_disable(sebool="selinuxuser_execstack") }}}
|
|
|
|
-rationale: ""
|
|
+rationale: |-
|
|
+ Disabling code execution from the stack blocks buffer overflow attacks.
|
|
|
|
severity: medium
|
|
|