1.6.1.2 Ensure the SELinux state is enforcing - sestatus

Information

Set SELinux to enable when the system is booted.

Rationale:

SELinux must be enabled at boot time in to ensure that the controls it provides are in effect at all times.

Solution

Edit the /etc/selinux/config file to set the SELINUX parameter:

SELINUX=enforcing

Edit /etc/default/grub and add the following parameters to the GRUB_CMDLINE_LINUX= line:

enforcing=1

Example:

GRUB_CMDLINE_LINUX_DEFAULT='quiet'
GRUB_CMDLINE_LINUX='selinux=1 security=selinux enforcing=1 audit=1'

Run the following command to update the grub2 configuration:

# update-grub

See Also

https://workbench.cisecurity.org/files/2619

Item Details

Category: ACCESS CONTROL

References: 800-53|AC-3, CSCv7|14.6

Plugin: Unix

Control ID: ca3abd244b02e0c93b7469d83f00720fbbc90a7be97b215b1c28f62e02952594