← Rules Catalog
mediumservicesverified

Disable interactive boot

interactive-boot-disabled · RHEL ≥ 8 · 1 impl

Description

The ability to spawn an interactive boot process must be disabled. Interactive boot allows bypassing normal security controls.

Rationale

Interactive boot mode could allow an attacker with physical access to bypass authentication and access the system.

Check → Remediate

Checkcommand
grep -E '^[^#]*systemd.confirm_spawn' /proc/cmdline && exit 1 || exit 0
expected_exit:
0
Remediategrub_parameter_remove
key:
systemd.confirm_spawn

Framework references

STIG

V-281300 / RHEL-10-700980V-257788 / RHEL-09-212015

NIST 800-53

CM-6AC-3

Live verification

rhel9:check
#boot#systemd#security