<Group id="selinux">
<title>SELinux</title>
<description>SELinux is a feature of the Linux kernel which can be
used to guard against misconfigured or compromised programs.
SELinux enforces the idea that programs should be limited in what
files they can access and what actions they can take.
<br /><br />
The default SELinux policy, as configured on Red Hat Enterprise Linux 7, has been
sufficiently developed and debugged that it should be usable on
almost any Red Hat machine with minimal configuration and a small
amount of system administrator training. This policy prevents
system services - including most of the common network-visible
services such as mail servers, FTP servers, and DNS servers - from
accessing files which those services have no valid reason to
access. This action alone prevents a huge amount of possible damage
from network attacks against services, from trojaned software, and
so forth.
<br /><br />
This guide recommends that SELinux be enabled using the
default (targeted) policy on every Red Hat system, unless that
system has unusual requirements which make a stronger policy
appropriate.
</description>


<Value id="var_selinux_state" type="string" operator="equals" interactive="0">
<title>SELinux state</title>
<description>enforcing - SELinux security policy is enforced.
<br />permissive - SELinux prints warnings instead of enforcing.
<br />disabled - SELinux is fully disabled.</description>
<value selector="">enforcing</value>
<value selector="enforcing">enforcing</value>
<value selector="permissive">permissive</value>
<value selector="disabled">disabled</value>
</Value>

<Value id="var_selinux_policy_name" type="string" operator="equals" interactive="0">
<title>SELinux policy</title>
<description>Type of policy in use. Possible values are:
<br />targeted - Only targeted network daemons are protected.
<br />strict - Full SELinux protection.
<br />mls - Multiple levels of security</description>
<value selector="">targeted</value>
<value selector="targeted">targeted</value>
<value selector="mls">mls</value>
</Value>

<Rule id="enable_selinux_bootloader" severity="medium">
<title>Ensure SELinux Not Disabled in /etc/grub.conf</title>
<description>SELinux can be disabled at boot time by an argument in
<tt>/etc/grub.conf</tt>.
Remove any instances of <tt>selinux=0</tt> from the kernel arguments in that
file to prevent SELinux from being disabled at boot.
</description>
<ocil clause="SELinux is disabled at boot time">
Inspect <tt>/etc/grub.conf</tt> for any instances of <tt>selinux=0</tt>
in the kernel boot arguments.  Presence of <tt>selinux=0</tt> indicates
that SELinux is disabled at boot time.
</ocil>
<rationale>
Disabling a major host protection feature, such as SELinux, at boot time prevents
it from confining system services at boot time.  Further, it increases
the chances that it will remain off during system operation.
</rationale>
<ident cce="RHEL7-CCE-TBD" />
<oval id="enable_selinux_bootloader" />
<ref nist="AC-3,AC-3(3),AC-6,AU-9" disa="22,32"/>
<tested by="DS" on="20121024"/>
</Rule>

<Rule id="selinux_state" severity="medium">
<title>Ensure SELinux State is Enforcing</title>
<description>The SELinux state should be set to <tt><sub idref="var_selinux_state" /></tt> at
system boot time.  In the file <tt>/etc/selinux/config</tt>, add or correct the
following line to configure the system to boot into enforcing mode:
<pre>SELINUX=<sub idref="var_selinux_state" /></pre>
</description>
<ocil clause="SELINUX is not set to enforcing">
Check the file <tt>/etc/selinux/config</tt> and ensure the following line appears:
<pre>SELINUX=<sub idref="var_selinux_state" /></pre>
</ocil>
<rationale>
Setting the SELinux state to enforcing ensures SELinux is able to confine
potentially compromised processes to the security policy, which is designed to
prevent them from causing damage to the system or further elevating their
privileges.
</rationale>
<ident cce="26800-3" />
<oval id="selinux_state" value="var_selinux_state"/>
<ref nist="AC-3,AC-3(3),AC-4,AC-6,AU-9" disa=""/>
<tested by="DS" on="20121024"/>
</Rule>

<Rule id="selinux_policytype">
<title>Configure SELinux Policy</title>
<description>The SELinux <tt>targeted</tt> policy is appropriate for
general-purpose desktops and servers, as well as systems in many other roles.
To configure the system to use this policy, add or correct the following line
in <tt>/etc/selinux/config</tt>:
<pre>SELINUXTYPE=<sub idref="var_selinux_policy_name" /></pre>
Other policies, such as <tt>mls</tt>, provide additional security labeling
and greater confinement but are not compatible with many general-purpose
use cases.
</description>
<ocil clause="it does not">
Check the file <tt>/etc/selinux/config</tt> and ensure the following line appears:
<pre>SELINUXTYPE=<sub idref="var_selinux_policy_name" /></pre>
</ocil>
<rationale>
Setting the SELinux policy to <tt>targeted</tt> or a more specialized policy
ensures the system will confine processes that are likely to be
targeted for exploitation, such as network or system services.

Note: During the development or debugging of SELinux modules, it is common to
temporarily place non-production systems in <tt>permissive</tt> mode. In such
temporary cases, SELinux policies should be developed, and once work
is completed, the system should be reconfigured to
<tt><sub idref="var_selinux_policy_name" /></tt>.
</rationale>
<ident cce="27135-3" />
<oval id="selinux_policytype" value="var_selinux_policy_name"/>
<ref nist="AC-3,AC-3(3),AC-4,AC-6,AU-9" disa=""/>
<tested by="DS" on="20121024"/>
</Rule>

<Rule id="package_setroubleshoot_removed">
<title>Uninstall setroubleshoot Package</title>
<description>The SETroubleshoot service notifies desktop users of SELinux
denials. The service provides information around configuration errors,
unauthorized intrusions, and other potential errors.
<package-remove-macro package="setroubleshoot" />
</description>
<rationale>The SETroubleshoot service is an unnecessary daemon to
have running on a server</rationale>
<ident cce="" />
<oval id="package_setroubleshoot_removed" />
</Rule>

<Rule id="package_mcstrans_removed">
<title>Uninstall mcstrans Package</title>
<description>The <tt>mcstransd</tt> daemon provides category label information
to client processes requesting information. The label translations are defined
in <tt>/etc/selinux/targeted/setrans.conf</tt>.
<package-remove-macro package="mcstrans" />
</description>
<rationale>Since this service is not used very often, disable it to reduce the
amount of potentially vulnerable code running on the system.

NOTE: This rule was added in support of the CIS RHEL6 v1.2.0 benchmark. Please
note that Red Hat does not feel this rule is security relevant.
</rationale>
<ident cce="" />
<oval id="package_mcstrans_removed" />
</Rule>

<Rule id="selinux_confinement_of_daemons" severity="medium">
<title>Ensure No Daemons are Unconfined by SELinux</title>
<description>
Daemons for which the SELinux policy does not contain rules will inherit the
context of the parent process. Because daemons are launched during
startup and descend from the <tt>init</tt> process, they inherit the <tt>initrc_t</tt> context.
<br/>
<br/>
To check for unconfined daemons, run the following command:
<pre>$ sudo ps -eZ | egrep "initrc" | egrep -vw "tr|ps|egrep|bash|awk" | tr ':' ' ' | awk '{ print $NF }'</pre>
It should produce no output in a well-configured system.
</description>
<rationale>
Daemons which run with the <tt>initrc_t</tt> context may cause AVC denials,
or allow privileges that the daemon does not require.
</rationale>
<ref nist="AC-6,AU-9,CM-7" />
<ident cce="RHEL7-CCE-TBD" />
</Rule>

<Rule id="selinux_all_devicefiles_labeled">
<title>Ensure No Device Files are Unlabeled by SELinux</title>
<description>Device files, which are used for communication with important
system resources, should be labeled with proper SELinux types. If any device
files carry the SELinux type <tt>unlabeled_t</tt>, investigate the cause and
correct the file's context.
</description>
<ocil clause="there is output">To check for unlabeled device files, run the following command:
<pre>$sudo find /dev -context *:device_t:* \( -type c -o -type b \) -printf "%p %Z\n"</pre>
It should produce no output in a well-configured system.</ocil>
<rationale>
If a device file carries the SELinux type <tt>unlabeled_t</tt>, then SELinux
cannot properly restrict access to the device file.
</rationale>
<ident cce="RHEL7-CCE-TBD" />
<oval id="selinux_all_devicefiles_labeled" />
<ref nist="AC-6,AU-9,CM-7" disa="22,32"/>
<tested by="DS" on="20121024"/>
</Rule>
</Group>
