Detections
Analytics

1.4.5 Ensure systemd ability to spawn an interactive boot process is disabled

Information

The systemd.confirm_spawn kernel argument causes systemd to prompt interactively at the console before spawning each unit during boot. Removing this argument prevents an interactive boot process.

An interactive boot process lets a person with console access influence which units start during boot, providing an avenue to interfere with the boot process. Ensuring systemd.confirm_spawn is not set removes that avenue.

Solution

Run the following command to remove the systemd.confirm_spawn argument from all boot entries:

# grubby --update-kernel ALL --remove-args=systemd.confirm_spawn

Then edit /etc/default/grub and remove systemd.confirm_spawn from the GRUB_CMDLINE_LINUX (and GRUB_CMDLINE_LINUX_DEFAULT ) line so it is not reintroduced on the next kernel or bootloader update. If the system uses /etc/kernel/cmdline, remove it there as well.

Impact:

None. systemd.confirm_spawn is a debugging aid and is not required for normal system operation.

See Also

https://workbench.cisecurity.org/benchmarks/27892

Item Details

Category: CONFIGURATION MANAGEMENT

References: 800-53|CM-7

Plugin: Unix

Control ID: de5db66f518fe855340731975153e781f4e95194edc112d9a83a7a794e8a923f