Guide to the Secure Configuration of Red Hat Enterprise Linux 9
Rules, Groups, and Values defined within the XCCDF Benchmark
-
Limit sampling frequency of the Perf system
To set the runtime status of the <code>kernel.perf_event_max_sample_rate</code> kernel parameter, run the following command: <pre>$ sudo sysctl -w ...Rule Medium Severity -
Disallow kernel profiling by unprivileged users
To set the runtime status of the <code>kernel.perf_event_paranoid</code> kernel parameter, run the following command: <pre>$ sudo sysctl -w kernel....Rule Low Severity -
Configure maximum number of process identifiers
To set the runtime status of the <code>kernel.pid_max</code> kernel parameter, run the following command: <pre>$ sudo sysctl -w kernel.pid_max=6553...Rule Medium Severity -
Disallow magic SysRq key
To set the runtime status of the <code>kernel.sysrq</code> kernel parameter, run the following command: <pre>$ sudo sysctl -w kernel.sysrq=0</pre> ...Rule Medium Severity -
Disable Access to Network bpf() Syscall From Unprivileged Processes
To set the runtime status of the <code>kernel.unprivileged_bpf_disabled</code> kernel parameter, run the following command: <pre>$ sudo sysctl -w k...Rule Medium Severity -
Disable core dump backtraces
The <code>ProcessSizeMax</code> option in <code>[Coredump]</code> section of <code>/etc/systemd/coredump.conf</code> specifies the maximum size in ...Rule Medium Severity -
Disable Access to Network bpf() Syscall From Unprivileged Processes
To prevent unprivileged processes from using the <code>bpf()</code> syscall the <code>kernel.unprivileged_bpf_disabled</code> kernel parameter must...Rule Medium Severity -
Restrict usage of ptrace to descendant processes
To set the runtime status of the <code>kernel.yama.ptrace_scope</code> kernel parameter, run the following command: <pre>$ sudo sysctl -w kernel.ya...Rule Medium Severity -
Harden the operation of the BPF just-in-time compiler
To set the runtime status of the <code>net.core.bpf_jit_harden</code> kernel parameter, run the following command: <pre>$ sudo sysctl -w net.core.b...Rule Medium Severity -
Disable the use of user namespaces
To set the runtime status of the <code>user.max_user_namespaces</code> kernel parameter, run the following command: <pre>$ sudo sysctl -w user.max_...Rule Medium Severity -
Prevent applications from mapping low portion of virtual memory
To set the runtime status of the <code>vm.mmap_min_addr</code> kernel parameter, run the following command: <pre>$ sudo sysctl -w vm.mmap_min_addr=...Rule Medium Severity -
Disable Core Dumps
A core dump file is the memory image of an executable program when it was terminated by the operating system due to errant behavior. In most cases,...Group -
Disable acquiring, saving, and processing core dumps
The <code>systemd-coredump.socket</code> unit is a socket activation of the <code>systemd-coredump@.service</code> which processes core dumps. By m...Rule Medium Severity -
Enable NX or XD Support in the BIOS
Reboot the system and enter the BIOS or Setup configuration menu. Navigate the BIOS configuration menu and make sure that the option is enabled. Th...Rule Medium Severity -
Disable storing core dump
The <code>Storage</code> option in <code>[Coredump]</code> sectionof <code>/etc/systemd/coredump.conf</code> can be set to <code>none</code> to dis...Rule Medium Severity -
Disable Core Dumps for All Users
To disable core dumps for all users, add the following line to <code>/etc/security/limits.conf</code>, or to a file within the <code>/etc/security/...Rule Medium Severity -
Disable Core Dumps for SUID programs
To set the runtime status of the <code>fs.suid_dumpable</code> kernel parameter, run the following command: <pre>$ sudo sysctl -w fs.suid_dumpable=...Rule Medium Severity -
Daemon Umask
The umask is a per-process setting which limits the default permissions for creation of new files and directories. The system includes initializati...Group -
daemon umask
Enter umask for daemonsValue -
Enable ExecShield
ExecShield describes kernel features that provide protection against exploitation of memory corruption errors such as buffer overflows. These featu...Group -
kernel.kptr_restrict
Configure exposition of kernel pointer addressesValue -
Enable ExecShield via sysctl
By default on Red Hat Enterprise Linux 9 64-bit systems, ExecShield is enabled and can only be disabled if the hardware does not support ExecShield...Rule Medium Severity -
Restrict Exposed Kernel Pointer Addresses Access
To set the runtime status of the <code>kernel.kptr_restrict</code> kernel parameter, run the following command: <pre>$ sudo sysctl -w kernel.kptr_r...Rule Medium Severity -
Enable Randomized Layout of Virtual Address Space
To set the runtime status of the <code>kernel.randomize_va_space</code> kernel parameter, run the following command: <pre>$ sudo sysctl -w kernel.r...Rule Medium Severity -
Enable Execute Disable (XD) or No Execute (NX) Support on x86 Systems
Recent processors in the x86 family support the ability to prevent code execution on a per memory page basis. Generically and on AMD processors, th...Group -
Enable page allocator poisoning
To enable poisoning of free pages, add the argument <code>page_poison=1</code> to the default GRUB 2 command line for the Linux operating system. T...Rule Medium Severity -
Enable SLUB/SLAB allocator poisoning
To enable poisoning of SLUB/SLAB objects, add the argument <code>slub_debug=<xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_slub_debug...Rule Medium Severity -
SELinux
SELinux is a feature of the Linux kernel which can be used to guard against misconfigured or compromised programs. SELinux enforces the idea that p...Group -
SELinux policy
Type of policy in use. Possible values are: <br>targeted - Only targeted network daemons are protected. <br>strict - Full SELinux protection. <br>m...Value -
SELinux state
enforcing - SELinux security policy is enforced. <br>permissive - SELinux prints warnings instead of enforcing. <br>disabled - SELinux is fully dis...Value -
Install libselinux Package
Thelibselinuxpackage can be installed with the following command:$ sudo dnf install libselinux
Rule High Severity -
Install policycoreutils-python-utils package
The <code>policycoreutils-python-utils</code> package can be installed with the following command: <pre> $ sudo dnf install policycoreutils-python-...Rule Medium Severity -
Install policycoreutils Package
Thepolicycoreutilspackage can be installed with the following command:$ sudo dnf install policycoreutils
Rule Low Severity -
Uninstall mcstrans Package
The <code>mcstransd</code> daemon provides category label information to client processes requesting information. The label translations are define...Rule Low Severity -
domain_fd_use SELinux Boolean
default - Default SELinux boolean setting.
on - SELinux boolean is enabled.
off - SELinux boolean is disabled.Value -
Uninstall setroubleshoot-plugins Package
The SETroubleshoot plugins are used to analyze SELinux AVC data. The service provides information around configuration errors, unauthorized intrusi...Rule Low Severity -
Uninstall setroubleshoot-server Package
The SETroubleshoot service notifies desktop users of SELinux denials. The service provides information around configuration errors, unauthorized in...Rule Low Severity -
Uninstall setroubleshoot Package
The SETroubleshoot service notifies desktop users of SELinux denials. The service provides information around configuration errors, unauthorized in...Rule Low Severity -
Ensure SELinux Not Disabled in the kernel arguments
SELinux can be disabled at boot time by disabling it via a kernel argument. Remove any instances of <code>selinux=0</code> from the kernel argument...Rule Medium Severity -
Ensure SELinux Not Disabled in /etc/default/grub
SELinux can be disabled at boot time by an argument in <code>/etc/default/grub</code>. Remove any instances of <code>selinux=0</code> from the kern...Rule Medium Severity -
Ensure No Device Files are Unlabeled by SELinux
Device files, which are used for communication with important system resources, should be labeled with proper SELinux types. If any device files ca...Rule Medium Severity -
Ensure No Daemons are Unconfined by SELinux
Daemons for which the SELinux policy does not contain rules will inherit the context of the parent process. Because daemons are launched during sta...Rule Medium Severity -
Ensure SELinux is Not Disabled
The SELinux state should be set to <code>enforcing</code> or <code>permissive</code> at system boot time. In the file <code>/etc/selinux/config</co...Rule High Severity -
Configure SELinux Policy
The SELinux <code>targeted</code> policy is appropriate for general-purpose desktops and servers, as well as systems in many other roles. To config...Rule Medium Severity -
Ensure SELinux State is Enforcing
The SELinux state should be set to <code><xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_selinux_state" use="legacy"></xccdf-1.2:sub><...Rule High Severity -
Map System Users To The Appropriate SELinux Role
Configure the operating system to prevent non-privileged users from executing privileged functions to include disabling, circumventing, or altering...Rule Medium Severity -
SELinux - Booleans
Enable or Disable runtime customization of SELinux system policies without having to reload or recompile the SELinux policy.Group -
abrt_anon_write SELinux Boolean
default - Default SELinux boolean setting.
on - SELinux boolean is enabled.
off - SELinux boolean is disabled.Value -
abrt_handle_event SELinux Boolean
default - Default SELinux boolean setting.
on - SELinux boolean is enabled.
off - SELinux boolean is disabled.Value -
abrt_upload_watch_anon_write SELinux Boolean
default - Default SELinux boolean setting.
on - SELinux boolean is enabled.
off - SELinux boolean is disabled.Value
Node 2
The content of the drawer really is up to you. It could have form fields, definition lists, text lists, labels, charts, progress bars, etc. Spacing recommendation is 24px margins. You can put tabs in here, and can also make the drawer scrollable.