Ensure the SELinux mode is enforcing

FaibleNiveau 2Automatiséelinux

Description

SELinux can run in one of three modes: disabled, permissive, or enforcing: • Enforcing - Is the default, and recommended, mode of operation; in enforcing mode SELinux operates normally, enforcing the loaded security policy on the entire system. • Permissive - The system acts as if SELinux is enforcing the loaded security policy, including labeling objects and emitting access denial entries in the logs, but it does not actually deny any operations. While not recommended for production systems, permissive mode can be helpful for SELinux policy development. • Disabled - Is strongly discouraged; n

Méthode de vérification

Méthode d'audit: Commande shell

shell

alt0() { command -v grep >/dev/null 2>&1 || { echo "step1: grep not installed"; return 1; }; o=$(bash -c 'grep -Pi -- '"'"'^\h*SELINUX=enforcing\b'"'"' /etc/selinux/config' 2>&1); printf '%s\n' "$o" | tr -s ' \t' '  ' | sed 's/^ //;s/ $//' | grep -Fxq -- SELINUX=enforcing || { echo step1: missing SELINUX=enforcing; return 1; }; command -v getenforce >/dev/null 2>&1 || { echo "step2: getenforce not installed"; return 1; }; o=$(bash -c getenforce 2>&1); printf '%s\n' "$o" | tr -s ' \t' '  ' | sed 's/^ //;s/ $//' | grep -Fxq -- Enforcing || { echo step2: missing Enforcing; return 1; }; }; if alt0; then echo compliant; fi

Sortie attendue: compliant

Méthode de correction

Méthode de correction: Recommandation ou correctif d'infrastructure

1. Edit /etc/selinux/config and update the SELINUX parameter to SELINUX=enforcing Example: SELINUX=enforcing 2. Update the SELinux running state to enforcing: • If SELinux is currently disabled: Run the following command to create /.autorelabel: # touch /.autorelabel Run the following command to reboot the system: # reboot WARNING: The autorelabel may be a long running process and require significant downtime. This should be planned for before executing the reboot! • If SELinux is not currently disabled: Run the following commands to set SELinux's running mode to Enforcing: # setenforce 1

Propriétés

Systèmes d'exploitation: rocky-9
Étiquettes: cis-convertedlinux
Référence: CIS Rocky Linux 9 Benchmark v3.0.0 - 1.3.1.5

Vérifier cet hôte

Exécutez cette commande sur une machine que vous êtes autorisé à auditer. L'analyse est en lecture seule.

shell

tmaegis scan --target linux --level 2