# Ensure No Unconfined Services Are Running on the System

- Source: https://support.icompaas.com/support/solutions/articles/62000235138-ensure-no-unconfined-services-are-running-on-the-system
- Section: [Solutions](https://support.icompaas.com/support/solutions) › [CIS Amazon Linux 2 Benchmark v3.0.0](https://support.icompaas.com/support/solutions/62000112696) › [CIS Amazon Linux 2 Benchmarks](https://support.icompaas.com/support/solutions/folders/62000169265)
- Last updated: 2026-05-29
- Publisher: iCompaas, Inc. (https://www.icompaas.com)

**Profile Applicability:** • Level 1

**Description:  
** Unconfined services run without SELinux policy enforcement, potentially increasing the risk of unauthorized actions or privilege escalation. Ensuring all services run confined by SELinux policies improves system security by enforcing mandatory access controls.

**Rationale:** Restricting all services to run under SELinux confinement minimizes attack surfaces and limits damage from compromised services.

**Impact:** Pros:

-   Enhances system security by enforcing SELinux confinement on all services.  
    
-   Reduces risk of privilege escalation and unauthorized access.  
    

Cons:

-   Some services may require policy tuning to operate correctly under confinement.  
    
-   Misconfiguration could cause service failures.  
    

**Default Value:** Some services may run unconfined by default depending on system configuration.

**Pre-requisites:**

-   Root or sudo privileges to audit and modify SELinux policies and service configurations.  
    

**Remediation:**

### **Test Plan:**

**Using Linux command line:**

1\. List all running services and their SELinux context:  

ps -eZ | grep unconfined\_service

2\. Identify services running in unconfined\_t or similar contexts:

ps -eZ | grep unconfined\_t

3\. Verify no critical services run unconfined.  

### **Implementation Plan:**

**Using Linux command line:**

1.  Create or adjust SELinux policies to confine unconfined services.  
    
2.  Reload or restart services to apply new SELinux contexts.  
    
3.  Audit SELinux logs for denials and adjust policies as needed.  
    

### **Backout Plan:**

**Using Linux command line:**

1.  Revert SELinux policy changes if services fail.  
    

2.  Temporarily set SELinux to permissive mode for troubleshooting:  
    
    setenforce 0
    
3.  Monitor system behavior and reapply policies carefully.  
    

**References:**

-   CIS Amazon Linux 2 Benchmark v3.0.0  
    
-   SELinux Project Documentation  
    
-   Red Hat SELinux Guide

## Related compliance guidance

- [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them.
- [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.