Enable the gssd_read_tmp SELinux Boolean

An XCCDF Rule

Description

By default, the SELinux boolean gssd_read_tmp is enabled. This setting allows gssd processes to access Kerberos to read TGTs in the temp directory. If this setting is disabled, it should be enabled. To enable the gssd_read_tmp SELinux boolean, run the following command:

$ sudo setsebool -P gssd_read_tmp on

ID: xccdf_org.ssgproject.content_rule_sebool_gssd_read_tmp
Severity: Medium
Updated: about 1 year ago

- name: Enable the gssd_read_tmp SELinux Boolean - Ensure python3-libsemanage Installed
  package:
    name: python3-libsemanage
    state: present
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:  - enable_strategy
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - sebool_gssd_read_tmp
- name: XCCDF Value var_gssd_read_tmp # promote to variable
  set_fact:
    var_gssd_read_tmp: !!str <xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_var_gssd_read_tmp" use="legacy"/>
  tags:
    - always

- name: Enable the gssd_read_tmp SELinux Boolean - Set SELinux Boolean gssd_read_tmp
    Accordingly
  seboolean:
    name: gssd_read_tmp
    state: '{{ var_gssd_read_tmp }}'
    persistent: true
  when:
  - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  - ansible_facts.selinux.status == 'enabled'
  tags:
  - enable_strategy
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - sebool_gssd_read_tmp

# Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then

if ! rpm -q --quiet "python3-libsemanage" ; then
    dnf install -y "python3-libsemanage"
fi

if selinuxenabled; then

    var_gssd_read_tmp='<xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_var_gssd_read_tmp" use="legacy"/>'

    setsebool -P gssd_read_tmp $var_gssd_read_tmp

else
    echo "Skipping remediation, SELinux is disabled";
    false
fi

else
    >&2 echo 'Remediation is not applicable, nothing was done'
fi

Enable the gssd_read_tmp SELinux Boolean

Description

Remediation - Ansible

Remediation - Shell Script