Verify Permissions On /etc/sestatus.conf File
Ensures /etc/sestatus.conf is not writable, executable, setuid/setgid or sticky for group or other, so only root can change the SELinux status-reporting configuration.
Checked against the resolved running state (e.g. sshd -T, sysctl, systemctl show), catches drop-ins and Includes a file read would miss. Caveat: runtime ≠ persistence; a value correct now may not survive a reboot.
Pavois asserts the effective configuration, the live, resolved state, not a file. File-based scanners (OVAL/SCAP, Lynis) miss Includes, drop-ins and runtime defaults; this check sees what is actually applied.
A mapping is a cross-reference to where each standard places this requirement, anchored and cross-validated, not a claim of equivalence. A passing check is evidence toward these references, how to read it.
Why this rule matters
/etc/sestatus.conf tells the sestatus -v command which files and processes to report SELinux context for. Although informational, it is part of the SELinux configuration set. If it is writable by group or other, an attacker could rewrite it so security audits report misleading SELinux state, masking a tampered system; setuid/setgid/executable bits have no purpose on a text file. Restricting permissions ensures only root controls the SELinux status reporting configuration.
What Pavois checks
Pavois reads the live mode bits of /etc/sestatus.conf on the target (executable/setuid/setgid/sticky/writable by group and other), the effective permissions enforced by the kernel, not a documented baseline. Permissions are inode metadata, so there is no include or drop-in to subvert. The only_if guard skips the control when the file is absent.
only_if { file('/etc/sestatus.conf').exist? }
describe file('/etc/sestatus.conf') do
it { should_not be_executable.by('owner') }
it { should_not be_setuid }
it { should_not be_executable.by('group') }
it { should_not be_writable.by('group') }
it { should_not be_setgid }
it { should_not be_executable.by('other') }
it { should_not be_writable.by('other') }
it { should_not be_sticky }
endHow to verify it is applied
Run stat -c '%A %U %G' /etc/sestatus.conf. Expected: mode -rw-r--r-- (0644) owned by root root, with no write bit for group/other and no s/t bits. Quick check: find /etc/sestatus.conf -perm /0133 must return nothing.
Inspect & investigate
Permission changes are not logged by default. Watch the file with auditd: auditctl -w /etc/sestatus.conf -p wa -k selinux, then review with grep 'key="selinux"' /var/log/audit/audit.log. The configuration's effect is visible by running sestatus -v. Current mode and ownership: stat /etc/sestatus.conf.
Remediation
No automated harden plan ships for this rule yet, so it must be applied manually: chown root:root /etc/sestatus.conf && chmod 0644 /etc/sestatus.conf. This clears any group/other write and any setuid/setgid/sticky bits while keeping the file world-readable.
Pavois applies this with its own harden engine, the plan below, not a shell script:
| mode | 0644 |
|---|---|
| path | /etc/sestatus.conf |
| resource | file |
pavois harden plan localwhere the target is local, a user@host SSH alias, or a container , Docs
Impact & precautions
Risk if left mis-set: a writable /etc/sestatus.conf lets a non-root user manipulate what sestatus -v reports, helping hide tampering from administrators. Applying the fix is safe: 0644 root:root is the standard mode and the file remains readable by the sestatus tooling. Precaution: keep the read bit for other so unprivileged status queries still work; no service restart is needed.
Standards mapping
| Standard | Reference | Type | Version | Confidence |
|---|---|---|---|---|
| ANSSI BP-028 | R50 | direct | 2.0 | high |
Each reference is a cross-reference anchored in the upstream benchmark and cross-validated against the SCAP Security Guide and ansible-lockdown, not a claim of equivalence. Direct = a prescriptive, line-level requirement; supporting = an abstract control family (NIST) the check provides evidence toward. How to read a mapping.