Ensure the SELinux mode is enforcing

BaixaNível 2Automatizadalinux

Descrição

SELinux can run in one of three modes: disabled, permissive, or enforcing: • Enforcing - Is the default, and recommended, mode of operation; in enforcing mode SELinux operates normally, enforcing the loaded security policy on the entire system. • Permissive - The system acts as if SELinux is enforcing the loaded security policy, including labeling objects and emitting access denial entries in the logs, but it does not actually deny any operations. While not recommended for production systems, permissive mode can be helpful for SELinux policy development. • Disabled - Is strongly discouraged; n

Como é verificado

Método de auditoria: Comando shell

shell

alt0() { command -v grep >/dev/null 2>&1 || { echo "step1: grep not installed"; return 1; }; o=$(bash -c 'grep -Pi -- '"'"'^\h*SELINUX=enforcing\b'"'"' /etc/selinux/config' 2>&1); printf '%s\n' "$o" | tr -s ' \t' '  ' | sed 's/^ //;s/ $//' | grep -Fxq -- SELINUX=enforcing || { echo step1: missing SELINUX=enforcing; return 1; }; command -v getenforce >/dev/null 2>&1 || { echo "step2: getenforce not installed"; return 1; }; o=$(bash -c getenforce 2>&1); printf '%s\n' "$o" | tr -s ' \t' '  ' | sed 's/^ //;s/ $//' | grep -Fxq -- Enforcing || { echo step2: missing Enforcing; return 1; }; }; if alt0; then echo compliant; fi

Saída esperada: compliant

Como é corrigido

Método de correção: Orientação ou patch de infraestrutura

1. Edit /etc/selinux/config and update the SELINUX parameter to SELINUX=enforcing Example: SELINUX=enforcing 2. Update the SELinux running state to enforcing: • If SELinux is currently disabled: Run the following command to create /.autorelabel: # touch /.autorelabel Run the following command to reboot the system: # reboot WARNING: The autorelabel may be a long running process and require significant downtime. This should be planed for before executing the reboot! • If SELinux is not currently disabled: Run the following commands to set SELinux's running mode to Enforcing: # setenforce 1

Propriedades

Sistemas operacionais: rocky-10
Tags: cis-convertedlinux
Referência: CIS Rocky Linux 10 Benchmark v1.0.0 - 1.3.1.5

Verificar este host

Execute isto em uma máquina que você tenha permissão para auditar. A varredura é somente leitura.

shell

tmaegis scan --target linux --level 2