Verify User Who Owns /etc/sestatus.conf File
Ensures the SELinux status-reporting config /etc/sestatus.conf is owned by root (UID 0).
Checked against a path’s metadata, mode, owner, group, SUID/SGID.
A mapping is a cross-reference to where each standard places this requirement, anchored and cross-validated, not a claim of equivalence. A passing check is evidence toward these references, how to read it.
Why this rule matters
The /etc/sestatus.conf file controls which files and processes the sestatus -v command reports on when verifying SELinux state. If a non-root account owns it, that user could alter the output an administrator relies on to confirm SELinux is enforcing, masking a weakened security context. Setting root (UID 0) as the owner ensures exclusive privileged control over this SELinux-related configuration.
What Pavois checks
Pavois inspects the live filesystem with the InSpec file('/etc/sestatus.conf') resource and asserts uid == 0, guarded by only_if. Reading the real inode owner reflects the effective on-disk state, catching a chown that could let a user manipulate SELinux status reporting.
only_if { file('/etc/sestatus.conf').exist? }
describe file('/etc/sestatus.conf') do
its('uid') { should eq 0 }
endHow to verify it is applied
Run stat -c '%U %u %n' /etc/sestatus.conf. Expected output: root 0 /etc/sestatus.conf. The numeric 0 confirms root ownership.
Inspect & investigate
Watch the file with auditctl -w /etc/sestatus.conf -p wa -k selinux-conf and inspect /var/log/audit/audit.log (grep 'key="selinux-conf"'). The effective SELinux mode itself is shown by sestatus and getenforce; AVC denials appear in the audit log (grep AVC).
Remediation
No automated remediation is shipped for this rule. Apply it manually with chown root /etc/sestatus.conf (run as root or via sudo); the file should remain group root and mode 0644.
Pavois applies this with its own harden engine, the plan below, not a shell script:
| owner | root |
|---|---|
| path | /etc/sestatus.conf |
| resource | file |
pavois harden plan localwhere the target is local, a user@host SSH alias, or a container , Docs
Impact & precautions
A non-root owner could manipulate what the SELinux status check reports, hiding a degraded posture. Risk of applying: none, /etc/sestatus.conf only influences sestatus -v output; chown root does not change SELinux enforcement or break any service.
Standards mapping
| Standard | Reference | Type | Version | Confidence |
|---|---|---|---|---|
| ANSSI BP-028 | R50 | direct | 2.0 | high |
Each reference is a cross-reference anchored in the upstream benchmark and cross-validated against the SCAP Security Guide and ansible-lockdown, not a claim of equivalence. Direct = a prescriptive, line-level requirement; supporting = an abstract control family (NIST) the check provides evidence toward. How to read a mapping.