Ensure the named_t Process Type is Not in Permissive Mode

低等級 2自動化bind

說明

In addition to setting the entire SELinux configuration in permissive mode, it is possible to set individual process types (domains) such as named_t into a permissive mode as well. The permissive mode will not prevent any access or actions, instead, any actions that would have been denied are simply logged. The audit runs semodule -l and fails when the permissive_named_t module is loaded.

檢查方式

稽核方法: Shell 指令

shell

command -v semodule >/dev/null 2>&1 || exit 1
out=$(semodule -l 2>/dev/null) || exit 1
printf '%s\n' "$out" | grep -q permissive_named_t && echo 'named_t is permissive' || echo compliant

預期輸出: compliant

修補方式

修補方法: 操作指南或基礎設施修補檔

Perform the following to implement the recommended state: If the named_t type is in permissive mode; the customized permissive mode should be deleted with the following semanage command. # semanage permissive -d named_t

屬性

作業系統: 不限
標籤: binddnsselinux
參考資料: CIS ISC BIND DNS Server 9.11 Benchmark v1.0.0 - 10.3 Ensure the named_t Process Type is Not in Permissive Mode

檢查此主機

請在您有權稽核的機器上執行此指令。掃描為唯讀操作。

shell

tmaegis scan --target bind --level 2