Ensure SELinux Is Enabled in Enforcing Mode

FaibleNiveau 2Automatiséeapache

Description

SELinux (Security-Enhanced Linux) is a Linux kernel security module that provides mandatory access control security policies with type enforcement that are checked after the traditional discretionary access controls. It was created by the US National Security Agency and can enforce rules on files and processes in a Linux system, and restrict actions, based on defined policies. sestatus must report both the current mode and the mode from the config file as enforcing. Not applicable without /etc/selinux/config.

Méthode de vérification

Méthode d'audit: Commande shell

shell

s=$(sestatus 2>/dev/null) || exit 1; printf '%s\n' "$s" | awk -F: 'tolower($1)~/current mode/{c=$2} tolower($1)~/mode from config file/{f=$2} END{gsub(/[[:space:]]/,"",c); gsub(/[[:space:]]/,"",f); print (c=="enforcing"&&f=="enforcing")?"compliant":"noncompliant"}'

Sortie attendue: compliant

Méthode de correction

Méthode de correction: Recommandation ou correctif d'infrastructure

Set SELINUX=enforcing in /etc/selinux/config and run setenforce 1 (reboot if SELinux was disabled).

Propriétés

Systèmes d'exploitation: Tous
Étiquettes: apacheselinux
Référence: CIS Apache HTTP Server 2.4 Benchmark v2.4.0 - 11.1 Ensure SELinux Is Enabled in Enforcing Mode

Vérifier cet hôte

Exécutez cette commande sur une machine que vous êtes autorisé à auditer. L'analyse est en lecture seule.

shell

tmaegis scan --target apache --level 2