documentation_complete: true

prodtype: rhel7

title: 'disable the selinuxuser_execstack SELinux Boolean'

description: |-
    By default, the SELinux boolean <tt>selinuxuser_execstack</tt> is enabled.
    This setting should be disabled as unconfined executables should not be able
    to make their stack executable.
    <sebool-macro enable="false" sebool="selinuxuser_execstack" />

rationale: ""

severity: medium

identifiers:
    cce@rhel7: RHEL7-CCE-TBD

references:
    hipaa: 164.308(a)(1)(ii)(D),164.308(a)(3),164.308(a)(4),164.310(b),164.310(c),164.312(a),164.312(e)
    stigid@rhel7: TBD

ocil_clause: 'selinuxuser_execstack is not disabled'

ocil: '<sebool-check-macro enable="false" sebool="selinuxuser_execstack" />'
