documentation_complete: true


title: 'Enable the USBGuard Service'

description: |-
    The USBGuard service should be enabled.
    {{{ describe_service_enable(service="usbguard") }}}

rationale: |-
    The <tt>usbguard</tt> service must be running in order to
    enforce the USB device authorization policy for all USB devices.

severity: medium

identifiers:
    cce@rhcos4: CCE-82537-2
    cce@rhel8: CCE-82853-3
    cce@rhel9: CCE-84205-4
    cce@rhel10: CCE-87560-9

references:
    nist: CM-8(3)(a),IA-3
    ospp: FMT_SMF_EXT.1
    srg: SRG-OS-000378-GPOS-00163,SRG-APP-000141-CTR-000315
    stigid@ol8: OL08-00-040141

ocil_clause: 'the service is not enabled'

ocil: |-
    {{{ ocil_service_enabled(service="usbguard") }}}

template:
    name: service_enabled
    vars:
        servicename: usbguard

fixtext: |-
    {{{ fixtext_service_enabled("usbguard") }}}

srg_requirement: '{{{ srg_requirement_service_enabled("usbguard") }}}'
