Detections
Analytics

1.299 RHEL-09-431015

Information

RHEL 9 must enable the SELinux targeted policy.

GROUP ID: V-258079
RULE ID: SV-258079r1045159

Setting the SELinux policy to "targeted" or a more specialized policy ensures the system will confine processes that are likely to be targeted for exploitation, such as network or system services.

Note: During the development or debugging of SELinux modules, it is common to temporarily place nonproduction systems in "permissive" mode. In such temporary cases, SELinux policies should be developed, and once work is completed, the system should be reconfigured to "targeted".

Solution

Configure RHEL 9 to use the targetd SELINUX policy.

Edit the file "/etc/selinux/config" and add or modify the following line:

SELINUXTYPE=targeted

A reboot is required for the changes to take effect.

See Also

https://workbench.cisecurity.org/benchmarks/22008

Item Details

Category: SYSTEM AND INFORMATION INTEGRITY

References: 800-53|SI-6a., CAT|II, CCI|CCI-002696, Rule-ID|SV-258079r1045159_rule, STIG-ID|RHEL-09-431015, Vuln-ID|V-258079

Plugin: Unix

Control ID: 23406bf88207a3a5635935172c8ab99033d824493c431406a23fb022d5e63223