Verify Permissions On /etc/selinux Directory

An XCCDF Rule

Description

To properly set the permissions of /etc/selinux, run the command:

$ sudo chmod 0755 /etc/selinux

Rationale

Setting correct permissions on the /etc/selinux directory is important because this directory hosts SELinux configuration. Protection of this directory is critical for system security. Restricting the permissions ensures exclusive control of the SELinux configuration.

ID: xccdf_org.ssgproject.content_rule_directory_permissions_etc_selinux
Severity: Medium
References: R50
Updated: 5 days ago

- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - configure_strategy
  - directory_permissions_etc_selinux  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Find /etc/selinux/ file(s)
  command: 'find -H /etc/selinux/ -maxdepth 1 -perm /u+s,g+ws,o+wt  -type d '
  register: files_found
  changed_when: false
  failed_when: false
  check_mode: false
  when: '"kernel" in ansible_facts.packages'
  tags:
  - configure_strategy
  - directory_permissions_etc_selinux
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Set permissions for /etc/selinux/ file(s)
  file:
    path: '{{ item }}'
    mode: u-s,g-ws,o-wt
    state: directory
  with_items:
  - '{{ files_found.stdout_lines }}'
  when: '"kernel" in ansible_facts.packages'
  tags:
  - configure_strategy
  - directory_permissions_etc_selinux
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

# Remediation is applicable only in certain platforms
if rpm --quiet -q kernel; then

find -H /etc/selinux/ -maxdepth 1 -perm /u+s,g+ws,o+wt -type d -exec chmod u-s,g-ws,o-wt {} \;

else    >&2 echo 'Remediation is not applicable, nothing was done'
fi

Verify Permissions On /etc/selinux Directory

Description

Rationale

Remediation - Ansible

Remediation - Shell Script