highsystemverified ✓

Ensure SELinux is not disabled in bootloader configuration

grub-selinux-not-disabled · RHEL ≥ 8 · 1 impl

Description

The selinux=0 kernel parameter must not be set in GRUB configuration. This parameter completely disables SELinux at boot time.

Rationale

SELinux provides mandatory access controls that protect system integrity. Disabling it at boot time removes all security protections provided by SELinux policies.

Check → Remediate

Checkcommand

! grubby --info=ALL 2>/dev/null | grep -qE '^args=.*selinux=0'

expected_exit:: 0

Remediatecommand_exec

grubby --update-kernel=ALL --remove-args='selinux=0'

Framework references

CIS

rhel9 1.3.1.2rhel8 1.3.1.2rhel10 1.3.1.2

NIST 800-53

AC-3AC-6

Live verification

rhel10:checkrhel8:checkrhel9:check

#grub#selinux#boot#security