Ensure no unconfined daemons exist (Scored)

Level 2 - Server 
Level 2 - Workstation

Daemons that are not defined in SELinux policy will inherit the security context of their parent process.

Since daemons are launched and descend from the init process, they will inherit the security context label initrc_t. This could cause the unintended consequence of giving the process more permission than it requires.

Run the following command and verify not output is produced:

# ps -eZ | egrep "initrc" | egrep -vw "tr|ps|egrep|bash|awk" | tr ':' ' ' | awk '{ print $NF }'

Investigate any unconfined daemons found during the audit action. They may need to have an existing security context assigned to them or a policy built for them.

Occasionally certain daemons such as backup or centralized management software may require running unconfined. Any such software should be carefully analyzed and documented before such an exception is made.

  • ubuntu1604/1/6/1/4.txt
  • Last modified: 2017/05/02 17:05
  • by