Detections
Analytics

1.3.1.5 Ensure the SELinux mode is enforcing

Information

SELinux can run in one of three modes: disabled, permissive, or enforcing:

 - Enforcing - Is the default, and recommended, mode of operation; in enforcing mode SELinux operates normally, enforcing the loaded security policy on the entire system.
 - Permissive - The system acts as if SELinux is enforcing the loaded security policy, including labeling objects and emitting access denial entries in the logs, but it does not actually deny any operations. While not recommended for production systems, permissive mode can be helpful for SELinux policy development.
 - Disabled - Is strongly discouraged; not only does the system avoid enforcing the SELinux policy, it also avoids labeling any persistent objects such as files, making it difficult to enable SELinux in the future

Note: You can set individual domains to permissive mode while the system runs in enforcing mode. For example, to make the httpd_t domain permissive:

# semanage permissive -a httpd_t

Running SELinux in disabled mode the system not only avoids enforcing the SELinux policy, it also avoids labeling any persistent objects such as files, making it difficult to enable SELinux in the future.

Running SELinux in Permissive mode, though helpful for developing SELinux policy, only logs access denial entries, but does not deny any operations.

Satisfies: SRG-OS-000445-GPOS-00199, SRG-OS-000134-GPOS-00068

Solution

- Edit /etc/selinux/config and update the SELINUX parameter to SELINUX=enforcing

Example:

SELINUX=enforcing
 - Update the SELinux running state to enforcing :

 - If SELinux is currently disabled:

Run the following command to create /.autorelabel :

# touch /.autorelabel

Run the following command to reboot the system:

# reboot

WARNING: The autorelabel may be a long running process and require significant downtime. This should be planed for before executing the reboot!

 - If SELinux is not currently disabled:

Run the following commands to set SELinux's running mode to Enforcing :

# setenforce 1

Impact:

Running SELinux in Enforcing mode may block intended access to files or processes if the SELinux policy is not correctly configured. If this occurs, review the system logs for details and update labels or policy as appropriate.

See Also

https://workbench.cisecurity.org/benchmarks/24009

Item Details

Category: SYSTEM AND COMMUNICATIONS PROTECTION, SYSTEM AND INFORMATION INTEGRITY

References: 800-53|SC-3, 800-53|SI-6a., CCI|CCI-001084, CCI|CCI-002696, CSCv7|14.6, Rule-ID|SV-230240r1017059_rule, Rule-ID|SV-248548r958518_rule, Rule-ID|SV-258078r958944_rule, Rule-ID|SV-269430r1050313_rule, Rule-ID|SV-271452r1091068_rule, STIG-ID|ALMA-09-041930, STIG-ID|RHEL-08-010170, STIG-ID|RHEL-09-431010

Plugin: Unix

Control ID: d31fa5b5fc9b5fa8e01bd551a1aab18fcba12dd3e4b8511e3f0704899e1b07f2