<Group id="selinux">
<title>SELinux</title>
<description>SELinux is a feature of the Linux kernel which can be
used to guard against misconfigured or compromised programs.
SELinux enforces the idea that programs should be limited in what
files they can access and what actions they can take.
<br /><br />
The default SELinux policy, as configured on Red Hat Enterprise Linux 6, has been
sufficiently developed and debugged that it should be usable on
almost any Red Hat machine with minimal configuration and a small
amount of system administrator training. This policy prevents
system services - including most of the common network-visible
services such as mail servers, FTP servers, and DNS servers - from
accessing files which those services have no valid reason to
access. This action alone prevents a huge amount of possible damage
from network attacks against services, from trojaned software, and
so forth.
<br /><br />
This guide recommends that SELinux be enabled using the
default (targeted) policy on every Red Hat system, unless that
system has requirements which make a stronger policy
appropriate.
</description>

<Group id="enabling_selinux">
<title>Enable SELinux</title>
<description>Edit the file <tt>/etc/selinux/config</tt>. Add or correct the
following lines:
<pre>SELINUX=enforcing
SELINUXTYPE=targeted</pre>
Edit the file <tt>/etc/grub.conf</tt>. Ensure that the following
arguments DO NOT appear on any kernel command line in the file:
<pre>selinux=0
enforcing=0</pre>
The directive <tt>SELINUX=enforcing</tt> enables SELinux at boot time.
If SELinux is suspected of involvement with boot-time problems
(unlikely), it is possible to boot into the warning-only mode
<tt>SELINUX=permissive</tt> for debugging purposes. Make certain to change
the mode back to enforcing after debugging, set the filesystems to
be relabeled for consistency using the command <tt>touch
/.autorelabel</tt>, and reboot.
<br /><br />
However, the Red Hat Enterprise Linux 6 default SELinux configuration should be
sufficiently reasonable that most systems will boot without serious
problems. Some applications that require deep or unusual system
privileges, such as virtual machine software, may not be compatible
with SELinux in its default configuration. However, this should be
uncommon, and SELinux's application support continues to improve.
In other cases, SELinux may reveal unusual or insecure program
behavior by design.
<br /><br />
The directive <tt>SELINUXTYPE=targeted</tt> configures SELinux to use
the default targeted policy.
<br /><br />
The SELinux boot mode specified in <tt>/etc/selinux/config</tt> can be
overridden by command-line arguments passed to the kernel. It is
necessary to check <tt>grub.conf</tt> to ensure that this has not been done
and to protect the boot process.
</description>

<Value id="var_selinux_state_name" type="string" operator="equals" interactive="0">
<title>SELinux state</title>
<description>enforcing - SELinux security policy is enforced.
<br />permissive - SELinux prints warnings instead of enforcing.
<br />disabled - SELinux is fully disabled.</description>
<value selector="">enforcing</value>
<value selector="enforcing">enforcing</value>
<value selector="permissive">permissive</value>
<value selector="disabled">disabled</value>
</Value>

<Value id="var_selinux_policy_name" type="string" operator="equals" interactive="0">
<title>SELinux policy</title>
<description>Type of policy in use. Possible values are:
<br />targeted - Only targeted network daemons are protected.
<br />strict - Full SELinux protection.
<br />mls - Multiple levels of security</description>
<value selector="">targeted</value>
<value selector="targeted">targeted</value>
<value selector="mls">mls</value>
</Value>

<Rule id="selinux_enforcing" severity="low">
<title>Ensure SELinux State is Enforcing and Policy is Targeted</title>
<description>The SELinux state should be set to <tt>enforcing</tt> and the 
SELinux policy should be set to <tt>targeted</tt> at
system boot time.  In the file <tt>/etc/selinux/config</tt>, add or correct the
following lines to configure the system to boot into enforcing mode with the 
targeted policy:
<pre>SELINUX=enforcing</pre>
<pre>SELINUXTYPE=targeted</pre>
</description>
<ocil clause="SELINUX is not set to enforcing">
Check the file <tt>/etc/selinux/config</tt> and ensure the following lines appears:
<pre>SELINUX=enforcing</pre>
<pre>SELINUXTYPE=targeted</pre>
</ocil>
<rationale>
Setting the SELinux state to <tt>enforcing</tt> ensures SELinux is able to confine
potentially compromised processes to the security policy, which is designed to
prevent them from causing damage to the system or further elevating their
privileges.
Setting the SELinux policy to <tt>targeted</tt> or a more specialized policy
ensures the system will confine processes that are likely to be
targeted for exploitation, such as network or system services.
</rationale>
<ident stig="GEN000000-LNX00800" />
<oval id="selinux_enforcing" value="var_selinux_policy_name" />
<ref nist="ECSC-1" disa="366" />
</Rule>
</Group>
</Group>
