mediumservicesverified ✓
Disable interactive boot
interactive-boot-disabled · RHEL ≥ 8 · 1 impl
Description
The ability to spawn an interactive boot process must be disabled. Interactive boot allows bypassing normal security controls.
Rationale
Interactive boot mode could allow an attacker with physical access to bypass authentication and access the system.
Check → Remediate
Checkcommand
grep -E '^[^#]*systemd.confirm_spawn' /proc/cmdline && exit 1 || exit 0
- expected_exit:
- 0
Remediategrub_parameter_remove
- key:
- systemd.confirm_spawn
Framework references
STIG
V-281300 / RHEL-10-700980V-257788 / RHEL-09-212015
NIST 800-53
CM-6AC-3
Live verification
rhel9:check
#boot#systemd#security