Detections
Analytics

1.3.1.6 Ensure the SELinux mode is enforcing

Information

SELinux can run in enforcing or permissive mode.

Enforcing - Is the recommended mode of operation; in enforcing mode SELinux operates normally, enforcing the loaded security policy on the entire system.

Note: You can set individual domains to permissive mode while the system runs in enforcing mode. For example, to make the httpd_t domain permissive:

# semanage permissive -a httpd_t

Running SELinux in disabled mode the system not only avoids enforcing the SELinux policy, it also avoids labeling any persistent objects such as files, making it difficult to enable SELinux in the future.

Running SELinux in Permissive mode, though helpful for developing SELinux policy, only logs access denial entries, but does not deny any operations.

Satisfies: SRG-OS-000445-GPOS-00199, SRG-OS-000134-GPOS-00068

Solution

- Reset the security context on the running system:

# restorecon -R /
 - Update the SELinux running state to enforcing :

Run the following command to create /etc/selinux/.autorelabel :

# touch /etc/selinux/.autorelabel
 - Edit /etc/selinux/config and update the SELINUX parameter to SELINUX=enforcing

Example:

SELINUX=enforcing

4.Run the following command to reboot the system:

# reboot

WARNING: The autorelabel may be a long running process and require significant downtime. This should be planed for before executing the reboot!

Note: Changing the SELinux mode temporarily can be done via the command setenforce 1

Impact:

Running SELinux in Enforcing mode may block intended access to files or processes if the SELinux policy is not correctly configured. If this occurs, review the system logs for details and update labels or policy as appropriate.

See Also

https://workbench.cisecurity.org/benchmarks/26236

Item Details

Category: SYSTEM AND COMMUNICATIONS PROTECTION, SYSTEM AND INFORMATION INTEGRITY

References: 800-53|SC-3, 800-53|SI-6a., CCI|CCI-001084, CCI|CCI-002696, CSCv7|14.6, Rule-ID|SV-230240r1017059_rule, Rule-ID|SV-248548r958518_rule, Rule-ID|SV-258078r958944_rule, Rule-ID|SV-269430r1050313_rule, Rule-ID|SV-271452r1091068_rule

Plugin: Unix

Control ID: 8d0252c90d2ba2cafb8a11ad913975a8b7963f631cfc40db3e460c8c2b453c62