CME-301
SELinux (Enforcing Mode)
Description
Mandatory access control system that confines processes to least-privilege security domains. Even if a process is compromised, it cannot access files, ports, or other processes outside its policy-defined domain.
CVSS Vector Impacts
| Metric | Transition | Rationale |
|---|---|---|
| Scope (S) | C → U | Compromised process cannot escape its SELinux domain to affect other services |
| Confidentiality (C) | H → L | Process cannot read files outside its policy-allowed set |
| Integrity (I) | H → L | Process cannot modify files or resources outside its domain |
CWE Relationships
Verification
Verify SELinux is in enforcing mode
$ getenforce
# Expected: Enforcing
# Expected: Enforcing
Platform: rhel
$ sestatus | grep 'Current mode'
# Expected: Current mode: enforcing
# Expected: Current mode: enforcing
Platform: rhel
Applicability (CVE 5.2.0 Schema)
| Vendor | Product | CPEs | Platforms | Status |
|---|---|---|---|---|
| redhat | enterprise_linux |
cpe:2.3:o:redhat:enterprise_linux:9:*:*:*:*:*:*:*cpe:2.3:o:redhat:enterprise_linux:8:*:*:*:*:*:*:*
|
x86_64, aarch64, s390x, ppc64le | applicable |
| fedoraproject | fedora |
cpe:2.3:o:fedoraproject:fedora:*:*:*:*:*:*:*:*
|
All | applicable |
| centos | centos_stream | All | applicable |