# Cis Apache24 11.3

> Cis Apache24 11.3 is an Agent Skill for devops & security published in the CyberStrikeus/CyberStrike repository on GitHub: a SKILL.md instruction file an AI agent can load to do this task.

Ensure the httpd_t Type is Not in Permissive Mode (Automated)

- Skill name: `cis-apache24-11.3`
- Category: [DevOps & Security](https://www.openparable.com/skill/devops-security/1)
- Source: https://github.com/CyberStrikeus/CyberStrike/blob/HEAD/.cyberstrike/skill/CIS_benchmarks/Server_Software/Apache_HTTP_Server/CIS_Apache_HTTP_Server_2.4_Benchmark_v2.3.0/cis-apache24-11.3/SKILL.md
- Repository: CyberStrikeus/CyberStrike (1,211 GitHub stars when collected)

## SKILL.md

# Ensure the httpd_t Type is Not in Permissive Mode (Automated)

## Profile Applicability

- Level 2

## Description

In addition to setting the entire SELinux configuration in permissive mode, it is possible to set individual process types (domains) such as `httpd_t` into a permissive mode as well. The permissive mode will not prevent any access or actions, instead, any actions that would have been denied are simply logged.

## Rationale

Usage of the permissive mode is helpful for testing and ensuring that SELinux will not prevent access that is necessary for the proper function of a web application. However, all access is allowed in permissive mode by SELinux.

## Audit

Perform the following steps to determine if the recommended state is implemented:

Check that the `httpd_t` process type (domain) is not in permissive mode with the `semodule` command. There should be no output if the type is not set to permissive.

```bash
# semodule -l | grep permissive_httpd_t
```

## Remediation

Perform the following to implement the recommended state:

If the `httpd_t` type is in permissive mode; the customized permissive mode should be deleted with the following `semanage` command.

```bash
# semanage permissive -d httpd_t
```

## Default Value

The `httpd_t` type is not in permissive mode by default.

## References

1. https://docs.redhat.com/en/documentation/Red_Hat_Enterprise_Linux/6/html/Security-Enhanced_Linux/sect-Security-Enhanced_Linux-Fixing_Problems-Permissive_Domains.html

## CIS Controls

**v8:**

- 2.5 Allowlist Authorized Software
  - Use technical controls, such as application allowlisting, to ensure that only authorized software can execute or be accessed. Reassess bi-annually, or more frequently.

**v7:**

- 3.3 Configure Data Access Control Lists
  - Configure data access control lists based on a user's need to know. Apply data access control lists, also known as access permissions, to local and remote file systems, databases, and applications.
- 2.7 Utilize Application Whitelisting
  - Utilize application whitelisting technology on all assets to ensure that only authorized software executes and all unauthorized software is blocked from executing on assets.

## Profile

- Level 2

---

Source: https://www.openparable.com/skill/devops-security/cis-apache24-11-3 (OpenParable). Cite the canonical URL above.