Verify User Who Owns /etc/selinux Directory
Ensures the /etc/selinux directory is owned by root (uid 0).
Checked against a path’s metadata, mode, owner, group, SUID/SGID.
A mapping is a cross-reference to where each standard places this requirement, anchored and cross-validated, not a claim of equivalence. A passing check is evidence toward these references, how to read it.
Why this rule matters
The /etc/selinux directory holds the SELinux configuration that governs the mandatory access control policy of the whole system. If its owner is not root (uid 0), a non-privileged user could edit config to set SELinux to permissive or disabled, neutralizing the kernel's mandatory access control without ever needing root. Root ownership ensures exclusive control of the SELinux configuration.
What Pavois checks
Pavois reads the effective owner uid of /etc/selinux from the filesystem (stat), reflecting the real on-disk state, including a directory recreated by a package or a botched chown, rather than a value inferred from policy text.
only_if { file('/etc/selinux').exist? }
describe file('/etc/selinux') do
its('uid') { should eq 0 }
endHow to verify it is applied
Run stat -c '%U' /etc/selinux. The expected output is root. Alternatively, ls -ld /etc/selinux should show root in the owner column.
Inspect & investigate
Ownership changes are not logged by default; inspect with ls -ld /etc/selinux and stat /etc/selinux. The current SELinux mode is shown by getenforce / sestatus. If auditd watches /etc/selinux, ownership changes appear in /var/log/audit/audit.log.
Remediation
No automated harden plan is defined for this rule, so it must be applied manually: chown root /etc/selinux. Verify afterwards with stat -c '%U' /etc/selinux.
Pavois applies this with its own harden engine, the plan below, not a shell script:
| owner | root |
|---|---|
| path | /etc/selinux |
| resource | file |
pavois harden plan localwhere the target is local, a user@host SSH alias, or a container , Docs
Impact & precautions
Setting the owner to root is the expected state and has no functional impact: SELinux management runs as root. There is no lockout risk, and the change does not alter the active policy or enforcement mode. It touches only directory metadata.
Standards mapping
| Standard | Reference | Type | Version | Confidence |
|---|---|---|---|---|
| ANSSI BP-028 | R50 | direct | 2.0 | high |
Each reference is a cross-reference anchored in the upstream benchmark and cross-validated against the SCAP Security Guide and ansible-lockdown, not a claim of equivalence. Direct = a prescriptive, line-level requirement; supporting = an abstract control family (NIST) the check provides evidence toward. How to read a mapping.