OL6-00-000023 - The system must use a Linux Security Module configured to limit the privileges of system services.

Information

Setting the SELinux policy to 'targeted' or a more specialized policy ensures the system will confine processes that are likely to be targeted for exploitation, such as network or system services.

Solution

The SELinux 'targeted' policy is appropriate for general-purpose desktops and servers, as well as systems in many other roles. To configure the system to use this policy, add or correct the following line in '/etc/selinux/config':

SELINUXTYPE=targeted

Other policies, such as 'mls', provide additional security labeling and greater confinement but are not compatible with many general-purpose use cases.

See Also

https://dl.dod.cyber.mil/wp-content/uploads/stigs/zip/U_Oracle_Linux_6_V2R7_STIG.zip

Item Details

Category: CONFIGURATION MANAGEMENT

References: 800-53|CM-6b., CAT|III, CCI|CCI-000366, Rule-ID|SV-208802r793587_rule, STIG-ID|OL6-00-000023, STIG-Legacy|SV-73799, STIG-Legacy|V-59369, Vuln-ID|V-208802

Plugin: Unix

Control ID: f691f105c00753814ef8e915ef83d424479431c136feb211541a379b25a7ae50