Ensure the SELinux mode is enforcing

NiedrigStufe 2Automatisiertlinux

Beschreibung

SELinux can run in one of three modes: disabled, permissive, or enforcing: • Enforcing - Is the default, and recommended, mode of operation; in enforcing mode SELinux operates normally, enforcing the loaded security policy on the entire system. • Permissive - The system acts as if SELinux is enforcing the loaded security policy, including labeling objects and emitting access denial entries in the logs, but it does not actually deny any operations. While not recommended for production systems, permissive mode can be helpful for SELinux policy development. • Disabled - Is strongly discouraged; n

So wird geprüft

Prüfmethode: Shell-Befehl

shell

alt0() { command -v grep >/dev/null 2>&1 || { echo "step1: grep not installed"; return 1; }; o=$(bash -c 'grep -Pi -- '"'"'^\h*SELINUX=enforcing\b'"'"' /etc/selinux/config' 2>&1); printf '%s\n' "$o" | tr -s ' \t' '  ' | sed 's/^ //;s/ $//' | grep -Fxq -- SELINUX=enforcing || { echo step1: missing SELINUX=enforcing; return 1; }; command -v getenforce >/dev/null 2>&1 || { echo "step2: getenforce not installed"; return 1; }; o=$(bash -c getenforce 2>&1); printf '%s\n' "$o" | tr -s ' \t' '  ' | sed 's/^ //;s/ $//' | grep -Fxq -- Enforcing || { echo step2: missing Enforcing; return 1; }; }; if alt0; then echo compliant; fi

Erwartete Ausgabe: compliant

So wird behoben

Behebungsmethode: Anleitung oder Infrastruktur-Patch

1. Edit /etc/selinux/config and update the SELINUX parameter to SELINUX=enforcing Example: SELINUX=enforcing 2. Update the SELinux running state to enforcing: • If SELinux is currently disabled: Run the following command to create /.autorelabel: # touch /.autorelabel Run the following command to reboot the system: # reboot WARNING: The autorelabel may be a long running process and require significant downtime. This should be planed for before executing the reboot! • If SELinux is not currently disabled: Run the following commands to set SELinux's running mode to Enforcing: # setenforce 1

Eigenschaften

Betriebssysteme: rocky-10
Tags: cis-convertedlinux
Referenz: CIS Rocky Linux 10 Benchmark v1.0.0 - 1.3.1.5

Diesen Host prüfen

Führen Sie dies auf einem Rechner aus, den Sie prüfen dürfen. Der Scan ist schreibgeschützt.

shell

tmaegis scan --target linux --level 2