Verify Group Who Owns /etc/selinux Directory
Ensures the /etc/selinux directory is group-owned by root.
Checked against a path’s metadata, mode, owner, group, SUID/SGID.
A mapping is a cross-reference to where each standard places this requirement, anchored and cross-validated, not a claim of equivalence. A passing check is evidence toward these references, how to read it.
Why this rule matters
The /etc/selinux directory holds the SELinux configuration that governs the mandatory access control policy of the whole system. If its group owner is not root, members of that group could modify the policy or switch SELinux to permissive mode, effectively disabling the kernel's last line of defense without root privileges.
What Pavois checks
Pavois reads the effective group owner of /etc/selinux as the kernel reports it (stat), not a value parsed from a config file. This catches the real state on disk, including a directory recreated by a package or a botched chgrp, that a file-based scanner inferring ownership from policy text would miss.
only_if { file('/etc/selinux').exist? }
describe file('/etc/selinux') do
its('group') { should eq 'root' }
endHow to verify it is applied
Run stat -c '%G' /etc/selinux. The expected output is root. You can also use ls -ld /etc/selinux and confirm the group column shows root.
Inspect & investigate
Ownership changes are not logged by default. Inspect the current state with ls -ld /etc/selinux and stat /etc/selinux. If auditd watches /etc/selinux, related chgrp/chown events appear in /var/log/audit/audit.log.
Remediation
Pavois's harden plan sets the group of the file resource /etc/selinux to root (equivalent to chgrp root /etc/selinux). It is applied with pavois harden apply.
Pavois applies this with its own harden engine, the plan below, not a shell script:
| group | root |
|---|---|
| path | /etc/selinux |
| resource | file |
pavois harden plan localwhere the target is local, a user@host SSH alias, or a container , Docs
Impact & precautions
Reassigning the group to root has no functional impact: /etc/selinux is meant to be root-owned. The only risk is if a non-root automation account legitimately relies on group access to read the policy, review such tooling before applying. The change does not modify the SELinux policy itself and cannot cause a lockout.
Standards mapping
| Standard | Reference | Type | Version | Confidence |
|---|---|---|---|---|
| ANSSI BP-028 | R50 | direct | 2.0 | high |
Each reference is a cross-reference anchored in the upstream benchmark and cross-validated against the SCAP Security Guide and ansible-lockdown, not a claim of equivalence. Direct = a prescriptive, line-level requirement; supporting = an abstract control family (NIST) the check provides evidence toward. How to read a mapping.