Detections
Analytics

1.3.1.3 Ensure SELinux policy is configured

Information

Configure SELinux to meet or exceed the default targeted policy, which constrains daemons and system software only.

Security configuration requirements vary from site to site. Some sites may mandate a policy that is stricter than the default policy, which is perfectly acceptable. This item is intended to ensure that at least the default recommendations are met.

Solution

Edit /etc/selinux/config and set the SELINUXTYPE line to targeted or mls :

Example:

SELINUXTYPE=targeted

See Also

https://workbench.cisecurity.org/benchmarks/27890

Item Details

Category: ACCESS CONTROL, MEDIA PROTECTION

References: 800-53|AC-3, 800-53|AC-5, 800-53|AC-6, 800-53|MP-2, CSCv7|14.6

Plugin: Unix

Control ID: 9d25454694cf2aedcb5cbb67e6cd493d4310e26902ade5f165ef52bc3c8bbffc