← All control domains
Mandatory Access Control: 1 control for Linux hardening
Pavois audits 1 control in the Mandatory Access Control hardening domain, across 4 systems and 4 standards (CIS, ANSSI BP-028, NIST 800-53, PCI DSS). Every control declares the evidence it gathers, its severity, its remediation and its standard references.
The domain in figures
| Controls | 1 |
| Severities | |
| Evidence gathered | |
| Standards | |
| Systems | FedoraRHEL 10 / Rocky 10 / AlmaLinux 10RHEL 8 / Rocky 8 / AlmaLinux 8RHEL 9 / Rocky 9 / AlmaLinux 9 |
| Coverage depth | in depth |
What does Pavois check in this domain?
- effective runtime 1
- Checked against the resolved running state (e.g. sshd -T, sysctl, systemctl show), catches drop-ins and Includes a file read would miss. Caveat: runtime ≠ persistence; a value correct now may not survive a reboot.
Which standards does this domain cover?
One effective-configuration check serves as evidence for several standards at once. The references below are the ones the corpus actually carries, never a claimed equivalence. how to read a standard mapping.
- CIS
- 1.3.1.5
- ANSSI BP-028
- R37
- NIST 800-53
- AC-3
- PCI DSS
- 1.2.6
The Mandatory Access Control control
| Ref | Rule | Sev. | OS | Standards |
|---|---|---|---|---|
| SOCLE-CLD-MAC-001 | Ensure SELinux State is Enforcing | high | 4 |