Ensure the SELinux mode is enforcing

BajaNivel 2Automatizadalinux

Descripción

SELinux can run in one of three modes: disabled, permissive, or enforcing: • Enforcing - Is the default, and recommended, mode of operation; in enforcing mode SELinux operates normally, enforcing the loaded security policy on the entire system. • Permissive - The system acts as if SELinux is enforcing the loaded security policy, including labeling objects and emitting access denial entries in the logs, but it does not actually deny any operations. While not recommended for production systems, permissive mode can be helpful for SELinux policy development. • Disabled - Is strongly discouraged; n

Cómo se verifica

Método de auditoría: Comando de shell

shell

alt0() { command -v grep >/dev/null 2>&1 || { echo "step1: grep not installed"; return 1; }; o=$(bash -c 'grep -Pi -- '"'"'^\h*SELINUX=enforcing\b'"'"' /etc/selinux/config' 2>&1); printf '%s\n' "$o" | tr -s ' \t' '  ' | sed 's/^ //;s/ $//' | grep -Fxq -- SELINUX=enforcing || { echo step1: missing SELINUX=enforcing; return 1; }; command -v getenforce >/dev/null 2>&1 || { echo "step2: getenforce not installed"; return 1; }; o=$(bash -c getenforce 2>&1); printf '%s\n' "$o" | tr -s ' \t' '  ' | sed 's/^ //;s/ $//' | grep -Fxq -- Enforcing || { echo step2: missing Enforcing; return 1; }; }; if alt0; then echo compliant; fi

Salida esperada: compliant

Cómo se corrige

Método de corrección: Guía o parche de infraestructura

1. Edit /etc/selinux/config and update the SELINUX parameter to SELINUX=enforcing Example: SELINUX=enforcing 2. Update the SELinux running state to enforcing: • If SELinux is currently disabled: Run the following command to create /.autorelabel: # touch /.autorelabel Run the following command to reboot the system: # reboot WARNING: The autorelabel may be a long running process and require significant downtime. This should be planned for before executing the reboot! • If SELinux is not currently disabled: Run the following commands to set SELinux's running mode to Enforcing: # setenforce 1

Propiedades

Sistemas operativos: rocky-9
Etiquetas: cis-convertedlinux
Referencia: CIS Rocky Linux 9 Benchmark v3.0.0 - 1.3.1.5

Verificar este host

Ejecute esto en un equipo que tenga permiso para auditar. El escaneo es de solo lectura.

shell

tmaegis scan --target linux --level 2