Verify Permissions On /etc/sestatus.conf File
An XCCDF Rule
Description
To properly set the permissions of /etc/sestatus.conf, run the command:
$ sudo chmod 0644 /etc/sestatus.conf
Rationale
Setting correct permissions on the /etc/sestatus.conf file is important because this file hosts SELinux configuration. Protection of this file is critical for system security. Restricting the permissions ensures exclusive control of the SELinux configuration.
- ID
- xccdf_org.ssgproject.content_rule_file_permissions_etc_sestatus_conf
- Severity
- Medium
- References
- Updated
Remediation - Shell Script
# Remediation is applicable only in certain platforms
if rpm --quiet -q kernel-default; then
chmod u-xs,g-xws,o-xwt /etc/sestatus.conf
else
Remediation - Ansible
- name: Gather the package facts
package_facts:
manager: auto
tags:
- configure_strategy
- file_permissions_etc_sestatus_conf