TMA-BOTTLEROCKET-1.5.1

Ensure SELinux is configured

HighLevel 1Automatedbottlerocket

Description

SELinux must be enabled and in enforcing mode. The audit runs sestatus and requires SELinux enabled with the fortified policy and enforcing current and configured mode (falls back to getenforce = Enforcing when sestatus is not present). Run tmaegis on the host through the admin container root shell (sudo sheltie).

How it is checked

Audit method: Shell command

shell

if command -v sestatus >/dev/null 2>&1; then
  out=$(sestatus 2>/dev/null) || exit 1
  bad=0
  for l in 'SELinux status: enabled' 'Loaded policy name: fortified' 'Current mode: enforcing' 'Mode from config file: enforcing'; do
    printf '%s\n' "$out" | tr -s ' \t' ' ' | grep -Fxq -- "$l" || { echo "missing: $l"; bad=1; }
  done
  [ "$bad" -eq 0 ] && echo compliant
else
  m=$(getenforce 2>/dev/null) || exit 1
  [ "$m" = Enforcing ] && echo compliant || echo "SELinux: $m"
fi

Expected output: compliant

How it is fixed

Fix method: Guidance or infrastructure patch

Replace the system or reinstall the distribution.

Properties

Operating systems: Any
Tags: bottlerocketsystem
Reference: CIS Bottlerocket Benchmark v1.0.0 - 1.5.1 Ensure SELinux is configured

Check this host

Run this on a machine you are allowed to audit. The scan is read-only.

shell

tmaegis scan --target bottlerocket