Ensure SELinux Not Disabled in /etc/default/grub
Ensures SELinux is not disabled via the kernel command line (no selinux=0), so its mandatory access control confines services from boot onward.
Checked against the resolved running state (e.g. sshd -T, sysctl, systemctl show), catches drop-ins and Includes a file read would miss. Caveat: runtime ≠ persistence; a value correct now may not survive a reboot.
Pavois asserts the effective configuration, the live, resolved state, not a file. File-based scanners (OVAL/SCAP, Lynis) miss Includes, drop-ins and runtime defaults; this check sees what is actually applied.
A mapping is a cross-reference to where each standard places this requirement, anchored and cross-validated, not a claim of equivalence. A passing check is evidence toward these references, how to read it.
Why this rule matters
SELinux is a primary mandatory access control (MAC) layer that confines services so a compromised process cannot freely access the rest of the system. Disabling it at boot with selinux=0 on the kernel command line stops SELinux from confining services from the very start, and once off at boot it is far more likely to stay disabled during normal operation, leaving the host without its main containment mechanism. SELinux must therefore not be turned off via the bootloader.
What Pavois checks
Pavois reads the live kernel command line from /proc/cmdline, the boot line the running kernel actually parsed, rather than /etc/default/grub. A file-based scan of GRUB can be misled by an edit that was never regenerated, or miss a selinux=0 that an earlier drop-in added; /proc/cmdline shows the parameter that is truly in effect for this boot. Cross-check the resulting mode with getenforce / sestatus.
describe file('/proc/cmdline') do
its('content') { should_not match(/\bselinux=0\b/) }
its('content') { should_not match(/\benforcing=0\b/) }
endHow to verify it is applied
Run cat /proc/cmdline and confirm there is no selinux=0 token on the boot line. Confirm SELinux is active with:
getenforce
Expected output is Enforcing (or at least Permissive, never Disabled). sestatus gives the full picture.
Inspect & investigate
SELinux decisions and denials are logged via the audit subsystem, inspect /var/log/audit/audit.log for type=AVC lines, or use journalctl -t setroubleshoot. The boot-time SELinux state is also printed in dmesg | grep -i selinux.
Remediation
This rule has no automated harden plan, so it must be applied manually: remove any selinux=0 (and enforcing=0) from the bootloader (/etc/default/grub, then grub2-mkconfig -o /boot/grub2/grub.cfg), set SELINUX=enforcing in /etc/selinux/config, and reboot. Pavois does not flip SELinux automatically because enabling enforcing mode on a system that has run without it can break unlabeled services until a relabel is done.
Pavois applies this with its own harden engine, the plan below, not a shell script:
| command | grubby --update-kernel=ALL --remove-args="selinux=0 enforcing=0" 2>/dev/null || true |
|---|---|
| name | selinux-cmdline-clean |
| not_if | ! grep -Eqs "selinux=0|enforcing=0" /proc/cmdline |
| reboot_required | true |
| resource | exec |
pavois harden plan localwhere the target is local, a user@host SSH alias, or a container , Docs
Impact & precautions
Enabling SELinux enforcement on a host that booted without it can block services that lack proper labels or policy. Precautions:
- Plan a full filesystem relabel (
fixfiles -F onbootthen reboot, ortouch /.autorelabel) when re-enabling SELinux. - Move to Permissive first to collect AVC denials, fix policy/booleans, then switch to Enforcing.
- Watch
/var/log/audit/audit.logfordeniedevents and resolve them before going Enforcing in production. - Removing
selinux=0applies after reboot, schedule a maintenance window.
Standards mapping
| Standard | Reference | Type | Version | Confidence |
|---|---|---|---|---|
| CIS | 1.3.1.2 | direct | per OS, see the benchmark table | high |
| NIST | 3.1.2 | supporting | 800-53 Rev 5 · 800-171 Rev 2 (pinned) | medium |
| PCI DSS | 1.2.6 | supporting | 4.0.1 | medium |
Each reference is a cross-reference anchored in the upstream benchmark and cross-validated against the SCAP Security Guide and ansible-lockdown, not a claim of equivalence. Direct = a prescriptive, line-level requirement; supporting = an abstract control family (NIST) the check provides evidence toward. How to read a mapping.