Install policycoreutils Package
Ensures the policycoreutils package is installed so the core SELinux management utilities are available.
Checked against what is installed or registered, packages present/absent, account databases.
Why this rule matters
SELinux (Security-Enhanced Linux) is a kernel feature that adds mandatory access controls enforcing policies based on Type Enforcement, Role-Based Access Control and Multi-Level Security. The policycoreutils package provides the core utilities required for basic operation of an SELinux-enabled system, load_policy (load policy), setfiles/restorecon (label filesystems), newrole, and so on. Without these utilities the system cannot reliably load, relabel or manage its SELinux policy, undermining a primary defense-in-depth layer that confines compromised services.
What Pavois checks
Pavois checks the effective package state with package('policycoreutils') (resolved through rpm). A system can have SELinux compiled into the kernel yet lack the userspace tools to relabel or reload policy; Pavois confirms the package is actually present rather than assuming SELinux being enforcing implies the utilities exist.
describe package('policycoreutils') do
it { should be_installed }
endHow to verify it is applied
Run rpm -q policycoreutils. Expected output is a versioned package name such as policycoreutils-3.x-.... You can confirm a key tool with restorecon -V /etc/passwd.
Inspect & investigate
Installation history is visible with dnf history and in /var/log/dnf.log. SELinux policy decisions and relabeling events are recorded by auditd in /var/log/audit/audit.log (look for type=AVC).
Remediation
Pavois's harden plan installs the policycoreutils package via the package resource (action: install). It is applied with pavois harden apply. This provides the tooling, but the SELinux mode (enforcing) and a relabel if needed are governed by separate controls.
Pavois applies this with its own harden engine, the plan below, not a shell script:
| action | install |
|---|---|
| name | policycoreutils |
| resource | package |
pavois harden plan localwhere the target is local, a user@host SSH alias, or a container , Docs
Impact & precautions
Installing policycoreutils is low-risk: it only adds utilities and does not change the running SELinux mode. The caution lies in how the tools are then used, a wrong restorecon -R / or a forced relabel can mislabel files and prevent services from starting. - Apply relabels deliberately and prefer targeted restorecon over a full filesystem relabel. - Keep console access available so you can recover if a relabel disrupts boot or login.