OL 9 must enable the SELinux targeted policy.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-271453	OL09-00-000065	SV-271453r1091071_rule	CCI-002696	medium
Description
Setting the SELinux policy to "targeted" or a more specialized policy ensures the system will confine processes that are likely to be targeted for exploitation, such as network or system services. Note: During the development or debugging of SELinux modules, it is common to temporarily place nonproduction systems in "permissive" mode. In such temporary cases, SELinux policies should be developed, and once work is completed, the system should be reconfigured to "targeted".
STIG			Date
Oracle Linux 9 Security Technical Implementation Guide			2026-02-17

Related Frameworks

1 mapping across 3 frameworks

SCF0 mappings

No source states a mapping between these directly.

Also reachable in 3 hops (1) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

CHG-06Control Functionality Verification

0.50

DISA STIG Benchmark (XCCDF)V1R5intersects(normalised)
DISA CCI List2025-01-23equal to(normalised)
SCF Secure Traceability Relationship Mapping (STRM)2026.2intersects

NIST 800-530 mappings

No source states a mapping between these directly.

Also reachable in 2 hops (14) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

AC-3(4)Discretionary Access Control

1.00

DISA STIG Benchmark (XCCDF)V1R5intersects(normalised)
DISA STIG Benchmark (XCCDF)3our copyintersects(normalised)
DISA STIG Benchmark (XCCDF)3intersects(normalised)
DISA CCI List2025-01-23equal to(normalised)

AU-12Audit Record Generation

1.00

DISA STIG Benchmark (XCCDF)V1R5intersects(normalised)
DISA STIG Benchmark (XCCDF)V1R4our copyintersects(normalised)
DISA STIG Benchmark (XCCDF)V1R4intersects(normalised)
DISA CCI List2025-01-23equal to(normalised)

AU-3Content of Audit Records

1.00

DISA STIG Benchmark (XCCDF)V1R5intersects(normalised)
DISA STIG Benchmark (XCCDF)V1R4our copyintersects(normalised)
DISA STIG Benchmark (XCCDF)V1R4intersects(normalised)
DISA CCI List2025-01-23equal to(normalised)

AU-3(1)Additional Audit Information

1.00

DISA STIG Benchmark (XCCDF)V1R5intersects(normalised)
DISA STIG Benchmark (XCCDF)V1R4our copyintersects(normalised)
DISA STIG Benchmark (XCCDF)V1R4intersects(normalised)
DISA CCI List2025-01-23equal to(normalised)

AU-8Time Stamps

1.00

DISA STIG Benchmark (XCCDF)V1R5intersects(normalised)
DISA STIG Benchmark (XCCDF)V1R4our copyintersects(normalised)
DISA STIG Benchmark (XCCDF)V1R4intersects(normalised)
DISA CCI List2025-01-23equal to(normalised)

AU-9Protection of Audit Information

1.00

DISA STIG Benchmark (XCCDF)V1R5intersects(normalised)
DISA STIG Benchmark (XCCDF)V1R1our copyintersects(normalised)
DISA STIG Benchmark (XCCDF)V1R1intersects(normalised)
DISA CCI List2025-01-23equal to(normalised)

CM-3(5)Automated Security Response

1.00

DISA STIG Benchmark (XCCDF)V1R5intersects(normalised)
DISA STIG Benchmark (XCCDF)3our copyintersects(normalised)
DISA STIG Benchmark (XCCDF)3intersects(normalised)
DISA CCI List2025-01-23equal to(normalised)

CM-5(1)Automated Access Enforcement and Audit Records

1.00

DISA STIG Benchmark (XCCDF)V1R5intersects(normalised)
DISA STIG Benchmark (XCCDF)V1R4our copyintersects(normalised)
DISA STIG Benchmark (XCCDF)V1R4intersects(normalised)
DISA CCI List2025-01-23equal to(normalised)

CM-5(6)Limit Library Privileges

1.00

DISA STIG Benchmark (XCCDF)V1R5intersects(normalised)
DISA STIG Benchmark (XCCDF)2our copyintersects(normalised)
DISA STIG Benchmark (XCCDF)2intersects(normalised)
DISA CCI List2025-01-23equal to(normalised)

CM-7(2)Prevent Program Execution

1.00

DISA STIG Benchmark (XCCDF)V1R5intersects(normalised)
DISA STIG Benchmark (XCCDF)2our copyintersects(normalised)
DISA STIG Benchmark (XCCDF)2intersects(normalised)
DISA CCI List2025-01-23equal to(normalised)

+4 more (top 10 by confidence shown)

CCI1 mapping

CCI-002696

1.00

DISA STIG Benchmark (XCCDF)V1R5intersects(normalised)

Details

Check Text (C-271453r1091071_chk)

Verify that OL 9 enables the SELinux targeted policy with the following command: $ sestatus | grep policy Loaded policy name: targeted If the loaded policy name is not "targeted", this is a finding.

Fix Text (F-75410r1091070_fix)

Configure OL 9 to use the targetd SELINUX policy. Edit the file "/etc/selinux/config" and add or modify the following line: SELINUXTYPE=targeted A reboot is required for the changes to take effect.