OL 8 must disable the debug-shell systemd service.
An XCCDF Rule
Description
<VulnDiscussion>The debug-shell requires no authentication and provides root privileges to anyone who has physical access to the machine. While this feature is disabled by default, masking it adds a layer of assurance that it will not be enabled via a dependency in "system". This also prevents attackers with physical access from trivially bypassing security on the machine through valid troubleshooting configurations and gaining root access when the system is rebooted.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>
- ID
- SV-248872r991589_rule
- Severity
- Low
- References
- Updated
Remediation - Manual Procedure
Configure the system to mask the "debug-shell systemd" service with the following command:
$ sudo systemctl mask debug-shell.service
Created symlink /etc/systemd/system/debug-shell.service -> /dev/null