Details

Set SELinux to enable when the system is booted.

Rationale:

SELinux must be enabled at boot time to ensure that the controls it provides are in effect at all times.

Solution

Edit the /etc/selinux/config file to set the SELINUX parameter:

SELINUX=enforcing

Supportive Information

The following resource is also helpful.

• https://workbench.cisecurity.org/files/3366

This security hardening control applies to the following category of controls within NIST 800-53: Access Control, Media Protection.This control applies to the following type of system Unix.

References

• 800-53|AC-3
• 800-53|MP-2
• CSCv7|14.6

Source

• Tenable.com/audits