lowsystemunverified
Ensure weak dependencies are not installed by dnf
dnf-weak-deps-disabled · RHEL ≥ 8 · 1 impl
Description
DNF must be configured with install_weak_deps=False in /etc/dnf/dnf.conf so optional "weak" dependencies (Recommends/Suggests) are not installed, keeping the package footprint minimal.
Rationale
Weak dependencies pull in software that was not explicitly requested, enlarging the attack surface with packages the operator did not intend to install.
Check → Remediate
Checkcommand
grep -qiE '^[[:space:]]*install_weak_deps[[:space:]]*=[[:space:]]*(False|0|no)[[:space:]]*$' /etc/dnf/dnf.conf
- expected_exit:
- 0
Remediateconfig_set
- path:
- /etc/dnf/dnf.conf
- key:
- install_weak_deps
- value:
- False
- separator:
- =
Framework references
CIS
rhel8 1.2.1.5rhel10 1.2.1.5
NIST 800-53
CM-7
#dnf#packages#weak-deps#attack-surface#cis