Puppet Class: security_baseline::rules::redhat::sec_mcstrans

Defined in:
manifests/rules/redhat/sec_mcstrans.pp

Summary

Ensure the MCS Translation Service (mcstrans) is not installed (Scored)

Overview

The mcstransd daemon provides category label information to client processes requesting information. The label translations are defined in /etc/selinux/targeted/setrans.conf

Rationale: Since this service is not used very often, remove it to reduce the amount of potentially vulnerable code running on the system.

Examples:

class security_baseline::rules::redhat::sec_mcstrans {
    enforce => true,
    message => 'Test',
    log_level => 'info'
}

Parameters:

  • enforce (Boolean) (defaults to: true) —

    Enforce the rule or just test and log

  • message (String) (defaults to: '') —

    Message to print into the log

  • log_level (String) (defaults to: '') —

    The log_level for the above message



28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
 
# File 'manifests/rules/redhat/sec_mcstrans.pp', line 28

class security_baseline::rules::redhat::sec_mcstrans (
  Boolean $enforce = true,
  String $message = '',
  String $log_level = ''
) {
  if($enforce) {
    ensure_packages(['mcstrans'], {
      ensure => 'purged',
    })
  } else {
    if($facts['security_baseline']['packages_installed']['mcstrans_pkg']) {
      echo { 'mcstrans':
        message  => $message,
        loglevel => $log_level,
        withpath => false,
      }
    }
  }
}