Install libselinux Package
Ensures the libselinux core library is installed so the system can enforce SELinux mandatory access controls.
Checked against what is installed or registered, packages present/absent, account databases.
A mapping is a cross-reference to where each standard places this requirement, anchored and cross-validated, not a claim of equivalence. A passing check is evidence toward these references, how to read it.
Why this rule matters
SELinux (Security-Enhanced Linux) is a kernel feature plus a set of utilities that add mandatory access controls (MAC) on top of standard Unix permissions. The libselinux package contains the core library every SELinux-aware tool links against. Without it, the userland SELinux toolchain cannot function and the system cannot enforce its MAC policy, removing a key layer of containment that limits the damage a compromised service can do.
What Pavois checks
Pavois queries the package database through the InSpec package('libselinux') resource and asserts should be_installed, resolving via rpm/dnf on RHEL-family systems. This reflects the effective inventory rather than inferring SELinux presence from /etc/selinux/config, which can exist even when the supporting libraries were removed. The package state is the ground truth for whether the SELinux userland can run at all.
describe package('libselinux') do
it { should be_installed }
endHow to verify it is applied
Run rpm -q libselinux. Applied: libselinux-3.x-...el9.x86_64; not applied: package libselinux is not installed. Confirm enforcement separately with sestatus (expect SELinux status: enabled and Current mode: enforcing).
Inspect & investigate
Package installation is logged by the package manager (dnf history, rpm -q --last libselinux). SELinux policy decisions and denials (AVC events) are recorded in /var/log/audit/audit.log and surfaced with ausearch -m AVC or journalctl -t setroubleshoot.
Remediation
Pavois's harden plan declares a package resource for libselinux with action install; pavois harden apply installs it through the native package manager. On RHEL-family systems this library is normally a base dependency, so this rule mainly guards against systems where it was deliberately stripped. Installing the library does not by itself switch SELinux into enforcing mode, that is governed by /etc/selinux/config and a separate control.
Pavois applies this with its own harden engine, the plan below, not a shell script:
| action | install |
|---|---|
| name | libselinux |
| resource | package |
pavois harden plan localwhere the target is local, a user@host SSH alias, or a container , Docs
Impact & precautions
Missing libselinux breaks the SELinux userland and prevents MAC enforcement, leaving the system without a major containment layer. Precautions: installing the library is safe and usually pulls in no behaviour change on its own. Risk comes from enabling enforcing mode afterwards: services lacking correct policy can be denied access and fail. Before switching to enforcing, run in permissive mode, review /var/log/audit/audit.log for AVC denials, and relabel the filesystem (fixfiles relabel or touch /.autorelabel then reboot) to avoid login or service failures.
Standards mapping
| Standard | Reference | Type | Version | Confidence |
|---|---|---|---|---|
| CIS | 1.3.1.1 | direct | per OS, see the benchmark table | high |
| PCI DSS | 1.2.6 | supporting | 4.0.1 | medium |
Each reference is a cross-reference anchored in the upstream benchmark and cross-validated against the SCAP Security Guide and ansible-lockdown, not a claim of equivalence. Direct = a prescriptive, line-level requirement; supporting = an abstract control family (NIST) the check provides evidence toward. How to read a mapping.