Detections
Analytics

1.6.1.6 Ensure no unconfined services exist

Warning! Audit Deprecated

This audit has been deprecated and will be removed in a future update.

View Next Audit Version

Information

Unconfined processes run in unconfined domains

Note: Occasionally certain daemons such as backup or centralized management software may require running unconfined. Any such software should be carefully analyzed and documented before such an exception is made.

For unconfined processes, SELinux policy rules are applied, but policy rules exist that allow processes running in unconfined domains almost all access. Processes running in unconfined domains fall back to using DAC rules exclusively. If an unconfined process is compromised, SELinux does not prevent an attacker from gaining access to system resources and data, but of course, DAC rules are still used. SELinux is a security enhancement on top of DAC rules - it does not replace them

Solution

Investigate any unconfined processes found during the audit action. They may need to have an existing security context assigned to them or a policy built for them.

See Also

https://workbench.cisecurity.org/benchmarks/8415

Item Details

References: CSCv7|9.2

Plugin: Unix

Control ID: e4f1f6e18479dc264e3fac2ce6e9d279df0a6954efbf9b79b505e4d7ce6b1758