lowservicesverified ✓rollback-safe
Ensure mcstrans is not installed
service-disable-mcstrans · RHEL ≥ 8 · 2 impls
Description
The mcstransd daemon provides MCS (Multi-Category Security) translation services for SELinux. It translates SELinux context labels to human-readable format. This service is not required for SELinux enforcement.
Rationale
The mcstrans daemon is not needed for SELinux operation and provides an additional attack surface. If an attacker can manipulate translations, it could lead to misleading security context information.
Check → Remediate
Checkpackage_state
- name:
- mcstrans
- state:
- absent
Remediatepackage_absent
- name:
- mcstrans
Framework references
CIS
rhel9 1.3.1.7rhel8 1.3.1.7rhel10 1.3.1.7
NIST 800-53
CM-7
Live verification
rhel10:checkrhel8:checkrhel9:check
#service#selinux#attack-surface