From 853fd4e2cbf8d5d248d70888cc0274a9036ab972 Mon Sep 17 00:00:00 2001
From: teacup-on-rockingchair
 <315160+teacup-on-rockingchair@users.noreply.github.com>
Date: Wed, 31 Jan 2024 06:17:46 +0100
Subject: [PATCH] Make additional check if selinux is actually enabled

---
 shared/applicability/oval/selinux_is_enabled.xml | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/shared/applicability/oval/selinux_is_enabled.xml b/shared/applicability/oval/selinux_is_enabled.xml
index 4c972c687af..5484e858459 100644
--- a/shared/applicability/oval/selinux_is_enabled.xml
+++ b/shared/applicability/oval/selinux_is_enabled.xml
@@ -10,6 +10,7 @@
     </metadata>
     <criteria operator="AND">
       <criterion comment="enforce is disabled" test_ref="test_etc_selinux_configured" />
+      <criterion comment="/sys/fs/selinux is present" test_ref="test_selinux_sys_fs_exist" />
     </criteria>
   </definition>
 
@@ -29,4 +30,12 @@
     <ind:subexpression datatype="string"
       operation="pattern match">^(enforcing|permissive)$</ind:subexpression>
   </ind:textfilecontent54_state>
+  <unix:file_test check="all" check_existence="all_exist" comment="check if /sys/fs/selinux exists" id="test_selinux_sys_fs_exist" version="1">
+    <unix:object object_ref="object_selinux_sys_fs_exist" />
+  </unix:file_test>
+
+  <unix:file_object comment="/sys/fs/selinux" id="object_selinux_sys_fs_exist" version="1">
+    <unix:path>/sys/fs/selinux</unix:path>
+    <unix:filename xsi:nil="true" />
+  </unix:file_object>
 </def-group>