Comment Comment by craig_s_bell For some distributions, CIS benchmarks (also used by various other security tools) now include guidelines for SELinux.I couldn't find it in the Debian spec (probably because it uses AppArmor), but the RHEL benchmark has these.Currently, server level 1 only requires permissive mode:https://www.tenable.com/audits/items/CIS_Red_Hat_Enterprise_... CIS Red Hat Enterprise Linux 9 v2.0.0 L1 Server — 1.3.1.4 Ensure the SELinux mode is not disabled ... While server level 2 specifies enforcing mode:https://www.tenable.com/audits/items/CIS_Red_Hat_Enterprise_... CIS Red Hat Enterprise Linux 9 v2.0.0 L2 Server — 1.3.1.5 Ensure the SELinux mode is enforcing parent craig_s_bell 2 years ago
I couldn't find it in the Debian spec (probably because it uses AppArmor), but the RHEL benchmark has these.
Currently, server level 1 only requires permissive mode:
https://www.tenable.com/audits/items/CIS_Red_Hat_Enterprise_...
... While server level 2 specifies enforcing mode:https://www.tenable.com/audits/items/CIS_Red_Hat_Enterprise_...