Skip to content
ATO Pathways
  Log In

Verify Permissions On /etc/sestatus.conf File

An XCCDF Rule

Description

To properly set the permissions of /etc/sestatus.conf, run the command: 

$ sudo chmod 0644 /etc/sestatus.conf

Rationale

Setting correct permissions on the /etc/sestatus.conf file is important because this file hosts SELinux configuration. Protection of this file is critical for system security. Restricting the permissions ensures exclusive control of the SELinux configuration.

ID
xccdf_org.ssgproject.content_rule_file_permissions_etc_sestatus_conf
Severity
Medium
References
Updated



Remediation - Ansible

- name: Test for existence /etc/sestatus.conf
  stat:
    path: /etc/sestatus.conf
  register: file_exists
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:

Remediation - Shell Script

# Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then

chmod u-xs,g-xws,o-xwt /etc/sestatus.conf

else