Description
SELinux can be disabled at boot time by disabling it via a kernel argument.
Remove any instances of selinux=0 from the kernel arguments in that
file to prevent SELinux from being disabled at boot.
Rationale
Disabling a major host protection feature, such as SELinux, at boot time prevents
it from confining system services at boot time. Further, it increases
the chances that it will remain off during system operation.
- ID
xccdf_org.ssgproject.content_rule_coreos_enable_selinux_kernel_argument
- References
CSC: Critical Security Controls
COBIT®: Control Objectives for Information and Related Technologies
SP 800-171 Rev. 1: Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations
CCI: Control Correlation Identifier
HIPAA: Health Insurance Portability and Accountability Act
ISA-62443-2-1-2009, Security for Industrial Automation and Control Systems Part 2-1: Establishing an Industrial Automation and Control Systems Security Program
ANSI/ISA-62443-3-3 (99.03.03)-2013 Security for industrial automation and control systems Part 3-3: System security requirements and security levels
CIP: Critical Infrastructure Protection
NIST Special Publication 800-53 (Revision 4): Security and Privacy Controls for Federal Information Systems and Organizations
Framework for Improving Critical Infrastructure Cybersecurity
App SRG: Application Server Security Requirements Guide