Red Hat Enterprise Linux 5 Security Technical Implementation Guide

The Red Hat Enterprise Linux 5 Security Technical Implementation Guide (V1 R18) has 571 STIG checks. New to STIG checklists? Read What is a STIG checklist?, CKL vs CKLB, and STIG vs SCAP benchmark.

Find STIG checks

571STIG checks

Search filters this STIG's checks locally. Separate terms must all match (use quotes for an exact phrase). A search you ran on the Search page carries over here.

Severity

Version

V1 · R18

CurrentPublished Fri Apr 28 2017

The system must use a Linux Security Module configured to limit the privileges of system services.

Red Hat Enterprise Linux 5 Security Technical Implementation Guide

Assessment Title

Rule Text

The system must use a Linux Security Module configured to limit the privileges of system services.

Description

Discussion Text

Linux Security Modules such as SELinux and AppArmor can be used to provide protection from software exploits by explicitly defining the privileges permitted to each software package.

New to STIG checklists? Read What is a STIG checklist? and CKL vs CKLB.

Objective

V-22584

Rule

SV-26978r1_rule

Severity

low

Rule Version

GEN000000-LNX00800

Documentable

false

IA Controls

NIST SP 800-53

Rev 5

Assessment Procedure

Check Text

Check if SELinux is enabled with at least a "targeted" policy.

# grep ^SELINUX /etc/sysconfig/selinux

If the SELINUX option is not set to "enforcing", this is a finding.
If the SELINUXTYPE option is not set to "targeted" or "strict", this is a finding.

If the use of the system is incompatible with the confines of SELinux this rule may be waived.

Implementation Procedure

Fix Text

Enable one of the SELinux policies.
Edit /etc/sysconfig/selinux and set the value of the SELINUX option to "enforcing" and SELINUXTYPE to "targeted" or "strict".
Restart the system.

STIG check 305 of 571 in the Red Hat Enterprise Linux 5 STIG checklist

← Previous · V-22583The system's local firewall must implement a deny-all, allow-by-exception policy.Next · V-22585 →The system's boot loader configuration file(s) must not have extended ACLs.