---
title: Ensure SELinux is Not Disabled
description: Datadog, the leading service for cloud-scale monitoring.
breadcrumbs: Docs > Datadog Security > OOTB Rules > Ensure SELinux is Not Disabled
---

> For the complete documentation index, see [llms.txt](https://docs.datadoghq.com/llms.txt).

# Ensure SELinux is Not Disabled
 
## Description{% #description %}

The SELinux state should be set to `enforcing` or `permissive` at system boot time. In the file `/etc/selinux/config`, add or correct the following line to configure the system to boot into enforcing or permissive mode:

```
SELINUX=enforcing
```

OR

```
SELINUX=permissive
```

If SELinux is currently disabled or not configured, ensure that all files have correct SELinux labels by running:

```
fixfiles onboot
```

Then reboot the system.

## Rationale{% #rationale %}

Running SELinux in disabled mode is strongly discouraged. It prevents enforcing the SELinux controls without a system reboot. It also avoids labeling any persistent objects such as files, making it difficult to enable SELinux in the future.

## Remediation{% #remediation %}

### Shell script{% #shell-script %}

The following script can be run on the host to remediate the issue.

```bash
#!/bin/bash

# Remediation is applicable only in certain platforms
if rpm --quiet -q kernel-core; then

# Check current SELinux state in config file
selinux_current_state=""
if [ -f "/etc/selinux/config" ]; then
    selinux_current_state=$(grep -oP '^\s*SELINUX=\K(enforcing|permissive|disabled)' /etc/selinux/config || true)
fi

# Only remediate if SELinux is disabled or not configured
# If already set to enforcing or permissive, it's compliant - preserve the current state
if [ "$selinux_current_state" != "enforcing" ] && [ "$selinux_current_state" != "permissive" ]; then
    # SELinux is disabled or not configured, set to permissive as a conservative approach
    if [ -e "/etc/selinux/config" ] ; then
    LC_ALL=C sed -i "/^SELINUX=/Id" "/etc/selinux/config"
else
    touch "/etc/selinux/config"
    chmod 0644 "/etc/selinux/config"
fi
# make sure file has newline at the end
sed -i -e '$a\' "/etc/selinux/config"

cp "/etc/selinux/config" "/etc/selinux/config.bak"
# Insert at the end of the file
printf '%s\n' "SELINUX=permissive" >> "/etc/selinux/config"
# Clean up after ourselves.
rm "/etc/selinux/config.bak"
    fixfiles onboot
fi

else
    >&2 echo 'Remediation is not applicable, nothing was done'
fi
```

### Ansible playbook{% #ansible-playbook %}

The following playbook can be run with Ansible to remediate the issue.

```go
- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - CCE-86151-8
  - NIST-800-171-03.01.02
  - high_severity
  - low_complexity
  - low_disruption
  - reboot_required
  - restrict_strategy
  - selinux_not_disabled

- name: Ensure SELinux is Not Disabled - Check current SELinux configuration
  ansible.builtin.command:
    cmd: grep -oP '^\s*SELINUX=\K(enforcing|permissive|disabled)' /etc/selinux/config
  register: selinux_config_state
  check_mode: false
  changed_when: false
  failed_when: false
  when: '"kernel-core" in ansible_facts.packages'
  tags:
  - CCE-86151-8
  - NIST-800-171-03.01.02
  - high_severity
  - low_complexity
  - low_disruption
  - reboot_required
  - restrict_strategy
  - selinux_not_disabled

- name: Ensure SELinux is Not Disabled - Set SELinux state to permissive if disabled
    or not configured
  block:

  - name: Ensure SELinux is Not Disabled
    block:

    - name: Check for duplicate values
      ansible.builtin.lineinfile:
        path: /etc/selinux/config
        create: true
        regexp: (?i)^SELINUX=
        mode: '0644'
        state: absent
      check_mode: true
      changed_when: false
      register: dupes

    - name: Deduplicate values from /etc/selinux/config
      ansible.builtin.lineinfile:
        path: /etc/selinux/config
        create: true
        regexp: (?i)^SELINUX=
        mode: '0644'
        state: absent
      when: dupes.found is defined and dupes.found > 1

    - name: Insert correct line to /etc/selinux/config
      ansible.builtin.lineinfile:
        path: /etc/selinux/config
        create: true
        regexp: (?i)^SELINUX=
        mode: '0644'
        line: SELINUX=permissive
        state: present

  - name: Ensure SELinux is Not Disabled - Mark system to relabel SELinux on next
      boot
    ansible.builtin.file:
      path: /.autorelabel
      state: touch
      access_time: preserve
      modification_time: preserve
      mode: 420
  when:
  - '"kernel-core" in ansible_facts.packages'
  - selinux_config_state.stdout not in ['enforcing', 'permissive']
  tags:
  - CCE-86151-8
  - NIST-800-171-03.01.02
  - high_severity
  - low_complexity
  - low_disruption
  - reboot_required
  - restrict_strategy
  - selinux_not_disabled
```

## Warning{% #warning %}

The automated remediation checks the SELinux configuration in /etc/selinux/config. If SELinux is already set to "enforcing" or "permissive", the current state is preserved and no changes are made. If SELinux is "disabled" or not configured, the remediation will adopt a conservative approach and set it to "permissive" in order to avoid any system disruption and give the administrator the opportunity to assess the impact and necessary efforts before setting it to "enforcing", which is strongly recommended.