documentation_complete: true


title: 'Enable the fips_mode SELinux Boolean'

description: |-
    By default, the SELinux boolean <tt>fips_mode</tt> is enabled.
    This allows all SELinux domains to execute in <tt>fips_mode</tt>.
    If this setting is disabled, it should be enabled.
    {{{ describe_sebool_enable(sebool="fips_mode") }}}

rationale: ""

severity: medium

references:
    cis-csc: '13'
    cobit5: APO01.06,DSS05.04,DSS05.07,DSS06.02
    cui: 3.13.11
    isa-62443-2013: 'SR 5.2'
    iso27001-2013: A.10.1.1,A.11.1.4,A.11.1.5,A.11.2.1,A.13.1.1,A.13.1.3,A.13.2.1,A.13.2.3,A.13.2.4,A.14.1.2,A.14.1.3,A.6.1.2,A.7.1.1,A.7.1.2,A.7.3.1,A.8.2.2,A.8.2.3,A.9.1.1,A.9.1.2,A.9.2.3,A.9.4.1,A.9.4.4,A.9.4.5
    nist: SC-12(2),SC-12(3),IA-7,SC-13,CM-6(a),SC-12
    nist-csf: PR.DS-5

{{{ complete_ocil_entry_sebool_enabled(sebool="fips_mode") }}}

template:
    name: sebool
    vars:
        seboolid: fips_mode
