TMA-APACHE-11.1

Ensure SELinux Is Enabled in Enforcing Mode

RendahLevel 2Otomatisapache

Deskripsi

SELinux (Security-Enhanced Linux) is a Linux kernel security module that provides mandatory access control security policies with type enforcement that are checked after the traditional discretionary access controls. It was created by the US National Security Agency and can enforce rules on files and processes in a Linux system, and restrict actions, based on defined policies. sestatus must report both the current mode and the mode from the config file as enforcing. Not applicable without /etc/selinux/config.

Cara pemeriksaan

Metode audit: Perintah shell

shell

s=$(sestatus 2>/dev/null) || exit 1; printf '%s\n' "$s" | awk -F: 'tolower($1)~/current mode/{c=$2} tolower($1)~/mode from config file/{f=$2} END{gsub(/[[:space:]]/,"",c); gsub(/[[:space:]]/,"",f); print (c=="enforcing"&&f=="enforcing")?"compliant":"noncompliant"}'

Output yang diharapkan: compliant

Cara perbaikan

Metode perbaikan: Panduan atau patch infrastruktur

Set SELINUX=enforcing in /etc/selinux/config and run setenforce 1 (reboot if SELinux was disabled).

Properti

Sistem operasi: Apa saja
Tag: apacheselinux
Referensi: CIS Apache HTTP Server 2.4 Benchmark v2.4.0 - 11.1 Ensure SELinux Is Enabled in Enforcing Mode

Periksa host ini

Jalankan ini pada mesin yang diizinkan untuk Anda audit. Pemindaian bersifat hanya baca.

shell

tmaegis scan --target apache --level 2