securing oracle linux 9 part 4 configuring and securing selinux

وحید نوروزی سیستم عامل و زیرساخت 29 July 2026 Hits: 5

In the previous section,

Securing Package Management and Local Repositories

was completed.

1. CIS Benchmark Requirements (Section 1.3.1)

This article covers and implements the following items from the CIS standard:

1.3.1.1 Ensure SELinux is installed (Automated)
1.3.1.2 Ensure SELinux is not disabled in bootloader configuration (Automated)
1.3.1.3 Ensure SELinux policy is configured (Automated)
1.3.1.4 Ensure the SELinux mode is not disabled (Automated)
1.3.1.5 Ensure the SELinux mode is enforcing (Automated)
1.3.1.6 Ensure no unconfined services exist (Manual)
1.3.1.7 Ensure the MCS Translation Service (mcstrans) is not installed (Automated)
1.3.1.8 Ensure SETroubleshoot is not installed (Automated)

2. Concept & Rationale

SELinux (Security-Enhanced Linux) is a Mandatory Access Control (MAC) system implemented in the Linux kernel. Unlike the traditional DAC (Discretionary Access Control) model where the root user has unrestricted access, SELinux defines policies that specify exactly which processes can access which files, directories, and ports.

Reducing the Attack Surface: Enabling SELinux guarantees that even if an attacker compromises a service (such as a web server or database) and executes arbitrary code, they cannot break out of that service's boundary to take over the entire operating system (preventing Privilege Escalation).
Removing Unsafe Packages: The mcstrans (labels translation service) and setroubleshoot (user-friendly security alerts) packages have historical vulnerabilities and can expose sensitive system details. Therefore, their presence on production servers is prohibited.

3. Compatibility with Oracle Database (RAC & Grid)

Potential Conflicts and Workarounds:

Official Support: Contrary to legacy practices, modern versions of Oracle Database (such as 19c and 23ai) running on Oracle Linux fully support SELinux in Enforcing mode with the targeted policy.
Oracle Grid Infrastructure and ASM: In cluster environments (Oracle RAC), Clusterware management scripts might occasionally be blocked by SELinux due to missing labels on temporary files.
Operational Recommendation: When installing Oracle, first set the system to Permissive mode, complete the installation, monitor the logs in /var/log/audit/audit.log, and use tools like audit2allow to generate custom policy modules if necessary. Once you verify that the cluster is functioning correctly, switch the mode to Enforcing.

4. How to Audit the Current Status (Audit Script)

This script automatically checks the installation status, bootloader configurations, and unconfined services:

Link to this script on GitHub:

modules/audit_04_Configure_SELinux.sh

If you are not familiar with Bash scripting, you can refer to the tutorial I have published on the website for DBAs.

Bash for Oracle DBAs

#!/bin/bash
# Script: audit_cis_1_3_1.sh
# Purpose: Audit SELinux Configurations (CIS 1.3.1)

echo "=========================================================================="
echo " CIS Requirement: 1.3.1 Configure SELinux"
echo " - Ensure SELinux is installed, enforcing, and targeted."
echo " - Ensure mcstrans and setroubleshoot are not installed."
echo " - Ensure bootloader has no selinux=0 or enforcing=0."
echo " Oracle Context: Oracle Database (19c/23ai) fully supports SELinux in"
echo " 'Enforcing' and 'Targeted' mode. In Oracle RAC/Grid, some Clusterware"
echo " temp files may need proper labels, but disabling SELinux is NOT required."
echo "=========================================================================="

FAIL_COUNT=0

echo -e "\n[*] 1. Checking SELinux Packages..."
if rpm -q libselinux >/dev/null 2>&1; then
echo -e " \e[32m[PASS]\e[0m libselinux is installed."
else
echo -e " \e[31m[FAIL]\e[0m libselinux is NOT installed."
FAIL_COUNT=$((FAIL_COUNT + 1))
fi

if rpm -q mcstrans setroubleshoot >/dev/null 2>&1; then
echo -e " \e[31m[FAIL]\e[0m Unsafe packages (mcstrans/setroubleshoot) are installed."
FAIL_COUNT=$((FAIL_COUNT + 1))
else
echo -e " \e[32m[PASS]\e[0m Unsafe packages are NOT installed."
fi

echo -e "\n[*] 2. Checking Bootloader configurations..."
if grubby --info=ALL | grep -E 'selinux=0|enforcing=0' >/dev/null 2>&1; then
echo -e " \e[31m[FAIL]\e[0m SELinux is disabled in bootloader (grub)."
FAIL_COUNT=$((FAIL_COUNT + 1))
else
echo -e " \e[32m[PASS]\e[0m Bootloader parameters are clean."
fi

echo -e "\n[*] 3. Checking SELinux Config File (/etc/selinux/config)..."
if grep -Eq '^SELINUX=enforcing' /etc/selinux/config; then
echo -e " \e[32m[PASS]\e[0m SELINUX is set to enforcing in config."
else
echo -e " \e[31m[FAIL]\e[0m SELINUX is NOT set to enforcing in config."
FAIL_COUNT=$((FAIL_COUNT + 1))
fi

if grep -Eq '^SELINUXTYPE=targeted' /etc/selinux/config; then
echo -e " \e[32m[PASS]\e[0m SELINUXTYPE is set to targeted in config."
else
echo -e " \e[31m[FAIL]\e[0m SELINUXTYPE is NOT set to targeted in config."
FAIL_COUNT=$((FAIL_COUNT + 1))
fi

echo -e "\n[*] 4. Checking Current SELinux Status..."
CURRENT_MODE=$(getenforce)
if [ "$CURRENT_MODE" == "Enforcing" ]; then
echo -e " \e[32m[PASS]\e[0m Current SELinux mode is Enforcing."
else
echo -e " \e[31m[FAIL]\e[0m Current SELinux mode is $CURRENT_MODE."
FAIL_COUNT=$((FAIL_COUNT + 1))
fi

echo -e "\n[*] 5. Checking for Unconfined Services..."
UNCONFINED=$(ps -eZ | grep unconfined_service_t)
if [ -z "$UNCONFINED" ]; then
echo -e " \e[32m[PASS]\e[0m No unconfined services found."
else
echo -e " \e[33m[WARN]\e[0m Unconfined services detected (Manual check required):"
echo "$UNCONFINED" | awk '{print " - " $NF}'
fi

if [ "$FAIL_COUNT" -eq 0 ]; then
echo -e "\n\e[32m[+] AUDIT RESULT: PASS\e[0m"
else
echo -e "\n\e[31m[-] AUDIT RESULT: FAIL ($FAIL_COUNT issues found)\e[0m"
fi

5. How to Apply Settings (Remediation Bash Script)

This script updates kernel settings, removes dangerous packages, and secures SELinux.

Link to this script on GitHub:

modules/remediate_04_Configure_SELinux.sh

#!/bin/bash
# Script: remediate_cis_1_3_1.sh
# Purpose: Harden SELinux Configurations (CIS 1.3.1)

if [ "$EUID" -ne 0 ]; then echo "Please run as root"; exit 1; fi

echo -e "\n[+] Applying Remediation for SELinux (CIS 1.3.1)..."

# 1. Ensure libselinux is installed (Using --nogpgcheck temporarily if local keys are not imported, but recommended to import keys first)
echo " [*] Ensuring libselinux is installed..."
dnf install -y libselinux -q

# 2. Remove unsafe SELinux troubleshooting tools (CIS 1.3.1.7, 1.3.1.8)
echo " [*] Removing unsafe SELinux packages (mcstrans, setroubleshoot)..."
dnf remove -y mcstrans setroubleshoot -q >/dev/null 2>&1

# 3. Remove selinux=0 or enforcing=0 from bootloader (CIS 1.3.1.2)
echo " [*] Hardening Bootloader parameters..."
grubby --update-kernel ALL --remove-args="selinux=0 enforcing=0"

# 4. Configure SELinux policy and mode in config file (CIS 1.3.1.3, 1.3.1.4, 1.3.1.5)
echo " [*] Enforcing SELinux 'targeted' policy in /etc/selinux/config..."
sed -i 's/^SELINUX=.*/SELINUX=enforcing/' /etc/selinux/config
sed -i 's/^SELINUXTYPE=.*/SELINUXTYPE=targeted/' /etc/selinux/config

# 5. Apply Enforcing mode immediately if possible
echo " [*] Applying SELinux state..."
if [ "$(getenforce)" != "Disabled" ]; then
setenforce 1
echo " [+] SELinux is set to Enforcing."
else
echo " [!] SELinux is currently Disabled in kernel. A REBOOT IS REQUIRED to activate Enforcing mode."
fi

echo -e "\n[+] SELinux configuration applied successfully."

Operational Note: Resolving issues related to unconfined_service_t (Section 1.3.1.6) is not an automated process and requires human assessment. If any such service is observed during the Audit step, you must write a custom policy using audit2allow or reinstall the service in accordance with the operating system standards.

In the next part, we will cover

Securing Bootloader (GRUB2) Configuration