# Cis Apache24 11.3

> Ensure the httpd_t Type is Not in Permissive Mode (Automated)

- Skill: `cyberstrikeus/cis-apache24-11-3` (Agent Skill)
- Install (CLI): `npx skillmds@latest add cyberstrikeus/cis-apache24-11-3`
- Raw SKILL.md: https://api.skillmd.com/api/skills/cyberstrikeus/cis-apache24-11-3/raw
- Safety review: PASS (external: skill-scanner PASS, skillspector PASS)
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Coding & Dev Tools
- Author: cyberstrikeus (https://skillmd.com/u/cyberstrikeus)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/cyberstrikeus/cis-apache24-11-3

---


# Ensure the httpd_t Type is Not in Permissive Mode (Automated)

## Profile Applicability

- Level 2

## Description

In addition to setting the entire SELinux configuration in permissive mode, it is possible to set individual process types (domains) such as `httpd_t` into a permissive mode as well. The permissive mode will not prevent any access or actions, instead, any actions that would have been denied are simply logged.

## Rationale

Usage of the permissive mode is helpful for testing and ensuring that SELinux will not prevent access that is necessary for the proper function of a web application. However, all access is allowed in permissive mode by SELinux.

## Audit

Perform the following steps to determine if the recommended state is implemented:

Check that the `httpd_t` process type (domain) is not in permissive mode with the `semodule` command. There should be no output if the type is not set to permissive.

```bash
# semodule -l | grep permissive_httpd_t
```

## Remediation

Perform the following to implement the recommended state:

If the `httpd_t` type is in permissive mode; the customized permissive mode should be deleted with the following `semanage` command.

```bash
# semanage permissive -d httpd_t
```

## Default Value

The `httpd_t` type is not in permissive mode by default.

## References

1. https://docs.redhat.com/en/documentation/Red_Hat_Enterprise_Linux/6/html/Security-Enhanced_Linux/sect-Security-Enhanced_Linux-Fixing_Problems-Permissive_Domains.html

## CIS Controls

**v8:**

- 2.5 Allowlist Authorized Software
  - Use technical controls, such as application allowlisting, to ensure that only authorized software can execute or be accessed. Reassess bi-annually, or more frequently.

**v7:**

- 3.3 Configure Data Access Control Lists
  - Configure data access control lists based on a user's need to know. Apply data access control lists, also known as access permissions, to local and remote file systems, databases, and applications.
- 2.7 Utilize Application Whitelisting
  - Utilize application whitelisting technology on all assets to ensure that only authorized software executes and all unauthorized software is blocked from executing on assets.

## Profile

- Level 2