Enable the USBGuard Service
An XCCDF Rule
Description
The USBGuard service should be enabled.
The usbguard service can be enabled with the following command:
$ sudo systemctl enable usbguard.service
Rationale
The usbguard service must be running in order to
enforce the USB device authorization policy for all USB devices.
- ID
- xccdf_org.ssgproject.content_rule_service_usbguard_enabled
- Severity
- Medium
- References
- Updated
Remediation - Puppet
include enable_usbguard
class enable_usbguard {
service {'usbguard':
enable => true,
ensure => 'running',
Remediation - Shell Script
# Remediation is applicable only in certain platforms
if ( [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ] && ! grep -q s390x /proc/sys/kernel/osrelease ); then
SYSTEMCTL_EXEC='/usr/bin/systemctl'
"$SYSTEMCTL_EXEC" unmask 'usbguard.service'
"$SYSTEMCTL_EXEC" start 'usbguard.service'
Remediation - Kubernetes Patch
---
apiVersion: machineconfiguration.openshift.io/v1
kind: MachineConfig
metadata:
annotations:
complianceascode.io/depends-on: xccdf_org.ssgproject.content_rule_package_usbguard_installed
Remediation - OS Build Blueprint
[customizations.services]
enabled = ["usbguard"]
Remediation - Ansible
- name: Enable service usbguard
block:
- name: Gather the package facts
package_facts:
manager: auto