Ensure debug-shell service is not enabled in zIPL
An XCCDF Rule
Description
systemd's debug-shell service is intended to
diagnose systemd related boot issues with various systemctl
commands. Once enabled and following a system reboot, the root shell
will be available on tty9 which is access by pressing
CTRL-ALT-F9. The debug-shell service should only be used
for systemd related issues and should otherwise be disabled.
By default, the debug-shell systemd service is already disabled.
Ensure the debug-shell is not enabled by the systemd.debug-shel=1
boot paramenter option.
Check that not boot entries in /boot/loader/entries/*.conf have
systemd.debug-shell=1 included in its options.
To ensure that new kernels and boot entries don't enable the debug-shell, check
that systemd.debug-shell=1 is not present in /etc/kernel/cmdline.
Rationale
This prevents attackers with physical access from trivially bypassing security on the machine through valid troubleshooting configurations and gaining root access when the system is rebooted.
- ID
- xccdf_org.ssgproject.content_rule_zipl_systemd_debug-shell_argument_absent
- Severity
- Medium
- References
- Updated