Detections
Analytics

1.3.1.2 Ensure SELinux is not disabled in bootloader configuration

Warning! Audit Deprecated

This audit has been deprecated and will be removed in a future update.

View Next Audit Version

Information

Configure SELINUX to be enabled at boot time and verify that it has not been overwritten by the grub boot parameters.

SELinux must be enabled at boot time in your grub configuration to ensure that the controls it provides are not overridden.

Solution

Run the following command to remove the selinux=0 and enforcing=0 parameters:

grubby --update-kernel ALL --remove-args "selinux=0 enforcing=0"

Run the following command to remove the selinux=0 and enforcing=0 parameters if they were created by the deprecated grub2-mkconfig command:

# grep -Prsq -- '\h*([^#\n\r]+\h+)?kernelopts=([^#\n\r]+\h+)?(selinux|enforcing)=0\b' /boot/grub2 /boot/efi && grub2-mkconfig -o "$(grep -Prl -- '\h*([^#\n\r]+\h+)?kernelopts=([^#\n\r]+\h+)?(selinux|enforcing)=0\b' /boot/grub2 /boot/efi)"

Impact:

Files created while SELinux is disabled are not labeled at all. This behavior causes problems when changing to enforcing mode because files are labeled incorrectly or are not labeled at all. To prevent incorrectly labeled and unlabeled files from causing problems, file systems are automatically relabeled when changing from the disabled state to permissive or enforcing mode. This can be a long running process that should be accounted for as it may extend downtime during initial re-boot.

See Also

https://workbench.cisecurity.org/benchmarks/18208

Item Details

References: CSCv7|14.6

Plugin: Unix

Control ID: b28ac17a3e3073f47a17ae7072a2e0a91f5cdf1825b6bc6542355bf8b3a042e2