STIGQter: STIG Summary: Cloud Linux AlmaLinux OS 9 Security Technical Implementation Guide Version: 1 Release: 7 Benchmark Date: 01 Jul 2026:

AlmaLinux OS 9 must use a Linux Security Module configured to enforce limits on system services.

DISA Rule

SV-269430r1050313_rule

Vulnerability Number

V-269430

Group Title

SRG-OS-000134-GPOS-00068

Rule Version

ALMA-09-041930

Severity

CAT II

CCI(s)

CCI-001084 - Isolate security functions from nonsecurity functions.

Weight

Fix Recommendation

Configure AlmaLinux OS 9 to verify correct operation of security functions.

Edit the file "/etc/selinux/config" and add or modify the following line:

SELINUX=enforcing

Update the grub bootloader settings:

$ grubby --args="selinux=1 enforcing=1" --update-kernel=ALL

A reboot is required for the changes to take effect.

Check Contents

Ensure that AlmaLinux OS 9 verifies correct operation of security functions through the use of SELinux with the following command:

$ getenforce

Enforcing

If SELINUX is not set to "Enforcing", this is a finding.

Verify that SELinux is configured to be enforcing at boot.

$ grep -E "^SELINUX=" /etc/selinux/config

SELINUX=enforcing

If SELINUX line is missing, commented out, or not set to "enforcing", this is a finding.

Verify that SELinux is enabled and Enforcing for all kernels:

$ grubby --info=ALL | grep -E 'selinux|enforcing'

args="ro audit=1 selinux=1 enforcing=1 audit_backlog_limit=8192 page_poison=1 vsyscall=none slub_debug=P pti=on iommu=force resume=/dev/mapper/luks-89bf0df8-547f-4613-af07-215e5f62e9a9 rd.luks.uuid=luks-8a7154ec-8eeb-46c8-9d75-66fc4b80d665 rd.lvm.lv=rootvg/root rd.luks.uuid=luks-89bf0df8-547f-4613-af07-215e5f62e9a9 rd.lvm.lv=rootvg/swap rd.shell=0 quiet splash fips=1 boot=UUID=eda01e9b-b7e1-431b-9549-16d5dcddf665"

args="ro audit=1 selinux=1 enforcing=1 audit_backlog_limit=8192 page_poison=1 vsyscall=none slub_debug=P pti=on iommu=force resume=/dev/mapper/luks-89bf0df8-547f-4613-af07-215e5f62e9a9 rd.luks.uuid=luks-8a7154ec-8eeb-46c8-9d75-66fc4b80d665 rd.lvm.lv=rootvg/root rd.luks.uuid=luks-89bf0df8-547f-4613-af07-215e5f62e9a9 rd.lvm.lv=rootvg/swap rd.shell=0 quiet splash fips=1 boot=UUID=eda01e9b-b7e1-431b-9549-16d5dcddf665"

If selinux=1 is missing or set to 0, or enforcing=1 is missing or set to 0, this is a finding.

Vulnerability Number

V-269430

Documentable

False

Rule Version

ALMA-09-041930

Severity Override Guidance

Check Content Reference

Target Key

5664