mediumaccess-controlverified ✓

Configure SELinux context for faillock tally directory

faillock-selinux-context · RHEL ≥ 8 · 1 impl

Description

The SELinux context type must be configured to allow the use of a nondefault faillock tally directory when faillock is configured to use a nondefault directory path.

Rationale

If faillock is configured to use a directory other than the default /var/run/faillock, that directory must have the correct SELinux context type (faillog_t) applied. Without correct labeling, SELinux will deny faillock access and authentication will fail.

Check → Remediate

Checkcommand

dir=$(grep -Po '^\s*dir\s*=\s*\K\S+' /etc/security/faillock.conf 2>/dev/null)
if [ -z "$dir" ]; then
  dir="/var/run/faillock"
fi
if [ -d "$dir" ]; then
  ls -dZ "$dir" 2>/dev/null | grep -q 'faillog_t'
else
  semanage fcontext -l 2>/dev/null | grep -q "$(echo "$dir" | sed 's|/|\\\\|g')"
fi

expected_exit:: 0

Remediatemanual

note:: Run: semanage fcontext -a -t faillog_t "/custom/faillock/dir(/.*)?" then restorecon -Rv /custom/faillock/dir to apply the context. Use the default /var/run/faillock unless a custom dir is required.

Framework references

STIG

V-281252 / RHEL-10-700430V-258080 / RHEL-09-431020V-250315

NIST 800-53

AC-7CM-6

Live verification

rhel8:checkrhel9:check

#pam#selinux#faillock#authentication