IOMMU configuration directive
An XCCDF Rule
Description
On x86 architecture supporting VT-d, the IOMMU manages the access control policy between the hardware devices and some of the system critical units such as the memory. Configure the default Grub2 kernel command line to contain iommu=force as follows:
# grub2-editenv - set "$(grub2-editenv - list | grep kernelopts) iommu=force"
warning alert: Functionality Warning
Depending on the hardware, devices and operating system used, enabling IOMMU can cause hardware instabilities. Proper function and stability should be assessed before applying remediation to production systems.
Rationale
On x86 architectures, activating the I/OMMU prevents the system from arbitrary accesses potentially made by hardware devices.
- ID
- xccdf_org.ssgproject.content_rule_grub2_enable_iommu_force
- Severity
- Unknown
- References
- Updated
Remediation - Ansible
- name: Gather the package facts
package_facts:
manager: auto
tags:
- CCE-91532-2
- grub2_enable_iommu_force
Remediation - OS Build Blueprint
[customizations.kernel]
append = "iommu=force"
Remediation - Shell Script
# Remediation is applicable only in certain platforms
if rpm --quiet -q grub2 && { [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; }; then
# Correct the form of default kernel command line in GRUB
if grep -q '^\s*GRUB_CMDLINE_LINUX=.*iommu=.*"' '/etc/default/grub' ; then
# modify the GRUB command-line if an iommu= arg already exists