1.6.1.3 Ensure SELinux policy is configured - sestatus

Information

Configure SELinux to meet or exceed the default targeted policy, which constrains daemons and system software only.

Rationale:

Security configuration requirements vary from site to site. Some sites may mandate a policy that is stricter than the default policy, which is perfectly acceptable. This item is intended to ensure that at least the default recommendations are met.

Solution

Edit the /etc/selinux/config file to set the SELINUXTYPE parameter:

SELINUXTYPE=targeted

Additional Information:

If your organization requires stricter policies, ensure that they are set in the /etc/selinux/config file.

NIST SP 800-53 Rev. 5:

AC-3

MP-2

See Also

https://workbench.cisecurity.org/files/3807

Item Details

Category: ACCESS CONTROL, MEDIA PROTECTION

References: 800-53|AC-3, 800-53|AC-5, 800-53|AC-6, 800-53|MP-2, CSCv7|14.6

Plugin: Unix

Control ID: a7aa06fb36808d3c60f94326564919e3e52bee076206c5f8c62419bff532fa56