lowservicesverified ✓rollback-safe
Ensure setroubleshoot is not installed
package-setroubleshoot-removed · RHEL ≥ 8 · 2 impls
Description
The setroubleshoot package provides tools for diagnosing SELinux policy issues. It should not be installed on production systems.
Rationale
While useful for development and troubleshooting, setroubleshoot provides information about SELinux denials that could aid attackers in understanding and bypassing security policies.
Check → Remediate
Checkpackage_state
- name:
- setroubleshoot
- state:
- absent
Remediatepackage_absent
- name:
- setroubleshoot
Framework references
CIS
rhel9 1.3.1.8rhel8 1.3.1.8rhel10 1.3.1.8
NIST 800-53
CM-7
Live verification
rhel10:checkrhel8:checkrhel9:check
#package#selinux#troubleshooting#attack-surface