documentation_complete: true

prodtype: rhel7

title: 'Disable the selinuxuser_rw_noexattrfile SELinux Boolean'

description: |-
    By default, the SELinux boolean <tt>selinuxuser_rw_noexattrfile</tt> is enabled.
    This setting should be disabled as users should not be able to read/write files
    on filesystems that do not have extended attributes e.g. FAT, CDROM, FLOPPY, etc.
    <sebool-macro enable="false" sebool="selinuxuser_rw_noexattrfile" />

rationale: ""

severity: medium

identifiers:
    cce@rhel7: RHEL7-CCE-TBD

references:
    disa: TBD
    nist: TBD
    srg: TBD
    stigid@rhel7: TBD

ocil_clause: 'selinuxuser_rw_noexattrfile is not enabled'

ocil: '<sebool-check-macro enable="false" sebool="selinuxuser_rw_noexattrfile" />'
