Verify Group Who Owns /etc/sestatus.conf File
Ensures the SELinux status-config file /etc/sestatus.conf is group-owned by root.
Checked against a path’s metadata, mode, owner, group, SUID/SGID.
A mapping is a cross-reference to where each standard places this requirement, anchored and cross-validated, not a claim of equivalence. A passing check is evidence toward these references, how to read it.
Why this rule matters
/etc/sestatus.conf controls which files and processes the sestatus -v command reports on when verifying SELinux state. If a non-root group owned it, an unprivileged user could edit it to hide security-relevant entries from operators, masking a misconfigured or disabled SELinux context. Group ownership by root ensures the SELinux status reporting stays trustworthy.
What Pavois checks
Pavois asserts the effective group of /etc/sestatus.conf is root via the InSpec file resource, reading the live inode. Guarded by only_if, the rule is skipped on hosts without the file. Checking the real on-disk owner catches drift from manual edits that a packaging manifest, recorded at install time, would not reveal.
only_if { file('/etc/sestatus.conf').exist? }
describe file('/etc/sestatus.conf') do
its('group') { should eq 'root' }
endHow to verify it is applied
Run stat -c '%G' /etc/sestatus.conf. Expected output: root.
Inspect & investigate
No service log records this file's ownership; confirm with stat -c '%n %U %G' /etc/sestatus.conf. SELinux state itself is reported by sestatus -v and getenforce; AVC denials appear in /var/log/audit/audit.log.
Remediation
Pavois's harden plan uses the file resource to set the group of /etc/sestatus.conf to root, equivalent to chgrp root /etc/sestatus.conf. Apply it with pavois harden apply.
Pavois applies this with its own harden engine, the plan below, not a shell script:
| group | root |
|---|---|
| path | /etc/sestatus.conf |
| resource | file |
pavois harden plan localwhere the target is local, a user@host SSH alias, or a container , Docs
Impact & precautions
Setting the group to root does not change the SELinux policy or any running process, it only affects who can edit the sestatus reporting config. No service restart, no lockout risk. Precaution: none of significance; confirm the file is a regular file before chgrp.
Standards mapping
| Standard | Reference | Type | Version | Confidence |
|---|---|---|---|---|
| ANSSI BP-028 | R50 | direct | 2.0 | high |
Each reference is a cross-reference anchored in the upstream benchmark and cross-validated against the SCAP Security Guide and ansible-lockdown, not a claim of equivalence. Direct = a prescriptive, line-level requirement; supporting = an abstract control family (NIST) the check provides evidence toward. How to read a mapping.