Details

Setting the SELinux policy to ‘targeted’ or a more specialized policy ensures the system will confine processes that are likely to be targeted for exploitation, such as network or system services.

Solution

The SELinux ‘targeted’ policy is appropriate for general-purpose desktops and servers, as well as systems in many other roles. To configure the system to use this policy, add or correct the following line in ‘/etc/selinux/config’:

SELINUXTYPE=targeted

Other policies, such as ‘mls’, provide additional security labeling and greater confinement but are not compatible with many general-purpose use cases.

Supportive Information

The following resource is also helpful.

• https://dl.dod.cyber.mil/wp-content/uploads/stigs/zip/U_Oracle_Linux_6_V1R18_STIG.zip

This security hardening control applies to the following category of controls within NIST 800-53: Configuration Management.This control applies to the following type of system Unix.

References

• 800-53|CM-6b.
• CAT|III
• CCI|CCI-000366
• Group-ID|V-59369
• Rule-ID|SV-208802r603263_rule
• STIG-ID|OL6-00-000023
• STIG-Legacy|SV-73799
• STIG-Legacy|V-59369
• Vuln-ID|V-208802

Source

• Tenable.com/audits