Skip to content
ATO Pathways
  Log In

Enable the USBGuard Service

An XCCDF Rule

Description

The USBGuard service should be enabled. The usbguard service can be enabled with the following command: 

$ sudo systemctl enable usbguard.service

Rationale

The usbguard service must be running in order to enforce the USB device authorization policy for all USB devices.

ID
xccdf_org.ssgproject.content_rule_service_usbguard_enabled
Severity
Medium
References
Updated



Remediation - Kubernetes Patch

---
apiVersion: machineconfiguration.openshift.io/v1
kind: MachineConfig
metadata:
  annotations:
    complianceascode.io/depends-on: xccdf_org.ssgproject.content_rule_package_usbguard_installed

Remediation - OS Build Blueprint


[customizations.services]
enabled = ["usbguard"]

Remediation - Ansible

- name: Enable service usbguard
  block:

  - name: Gather the package facts
    package_facts:
      manager: auto

Remediation - Puppet

include enable_usbguard

class enable_usbguard {
  service {'usbguard':
    enable => true,
    ensure => 'running',

Remediation - Shell Script

# Remediation is applicable only in certain platforms
if ( [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ] && ! grep -q s390x /proc/sys/kernel/osrelease ); then

SYSTEMCTL_EXEC='/usr/bin/systemctl'
"$SYSTEMCTL_EXEC" unmask 'usbguard.service'
"$SYSTEMCTL_EXEC" start 'usbguard.service'