V-250312

Discussion

Preventing nonprivileged users from executing privileged functions mitigates the risk that unauthorized individuals or processes may gain unnecessary access to information or privileges. Privileged functions include, for example, establishing accounts, performing system integrity checks, or administering cryptographic key management activities. Nonprivileged users are individuals who do not possess appropriate authorizations. Circumventing intrusion detection and prevention mechanisms or malicious code protection mechanisms are examples of privileged functions that require protection from nonprivileged users.

Check Content

Verify the operating system confines SELinux users to roles that conform to least privilege.

Check the SELinux User list to SELinux Roles mapping by using the following command:

     $ sudo semanage user -l

                                     Labeling  MLS/               MLS/
     SELinux User      Prefix       MCS Level    MCS Range          SELinux Roles

     guest_u                user          s0                     s0                             guest_r
     root                        user          s0                     s0-s0:c0.c1023    staff_r sysadm_r system_r unconfined_r
     staff_u                  user          s0                     s0-s0:c0.c1023    staff_r sysadm_r system_r unconfined_r
     sysadm_u            user          s0                     s0-s0:c0.c1023    sysadm_r
     system_u             user          s0                     s0-s0:c0.c1023    system_r unconfined_r
     unconfined_u    user          s0                     s0-s0:c0.c1023    system_r unconfined_r
     user_u                   user          s0                     s0                            user_r
     xguest_u              user          s0                     s0                            xguest_r

If the output differs from the above example, ask the system administrator (SA) to demonstrate how the SELinux User mappings are exercising least privilege. If deviations from the example are not documented with the information system security officer (ISSO) and do not demonstrate least privilege, this is a finding.