documentation_complete: true


title: 'Verify that Interactive Boot is Disabled'

description: |-
    {{{ full_name }}} systems support an "interactive boot" option that can
    be used to prevent services from being started. On a {{{ full_name }}}
    system, interactive boot can be enabled by providing a <tt>1</tt>,
    <tt>yes</tt>, <tt>true</tt>, or <tt>on</tt> value to the
    <tt>systemd.confirm_spawn</tt> kernel argument in <tt>/etc/default/grub</tt>.
    Remove any instance of <pre>systemd.confirm_spawn=(1|yes|true|on)</pre> from
    the kernel arguments in that file to disable interactive boot.
    Recovery booting must also be disabled. Confirm that
    <tt>GRUB_DISABLE_RECOVERY=true</tt> is set in  <tt>/etc/default/grub</tt>.
    It is also required to change the runtime configuration, run:
    {{% if 'sle' in product %}}
    <pre>/usr/bin/grub2-editenv - unset systemd.confirm_spawn></pre>
    {{% else %}}
    <pre>/sbin/grubby --update-kernel=ALL --remove-args="systemd.confirm_spawn"</pre>
    {{% endif %}}
    <pre>grub2-mkconfig -o {{{ grub2_boot_path }}}/grub.cfg</pre>

rationale: |-
    Using interactive or recovery boot, the console user could disable auditing, firewalls,
    or other services, weakening system security.

severity: medium

identifiers:
    cce@rhcos4: CCE-82551-3
    cce@rhel8: CCE-80826-1
    cce@rhel9: CCE-87114-5
    cce@rhel10: CCE-89661-3
    cce@sle15: CCE-91152-9
    cce@sle16: CCE-96593-9

references:
    cis-csc: 11,12,14,15,16,18,3,5
    cobit5: DSS05.02,DSS05.04,DSS05.05,DSS05.07,DSS06.03,DSS06.06
    cui: 3.1.2,3.4.5
    hipaa: 164.308(a)(1)(ii)(B),164.308(a)(7)(i),164.308(a)(7)(ii)(A),164.310(a)(1),164.310(a)(2)(i),164.310(a)(2)(ii),164.310(a)(2)(iii),164.310(b),164.310(c),164.310(d)(1),164.310(d)(2)(iii)
    isa-62443-2009: 4.3.3.2.2,4.3.3.5.1,4.3.3.5.2,4.3.3.5.3,4.3.3.5.4,4.3.3.5.5,4.3.3.5.6,4.3.3.5.7,4.3.3.5.8,4.3.3.6.1,4.3.3.6.2,4.3.3.6.3,4.3.3.6.4,4.3.3.6.5,4.3.3.6.6,4.3.3.6.7,4.3.3.6.8,4.3.3.6.9,4.3.3.7.1,4.3.3.7.2,4.3.3.7.3,4.3.3.7.4
    isa-62443-2013: 'SR 1.1,SR 1.10,SR 1.11,SR 1.12,SR 1.13,SR 1.2,SR 1.3,SR 1.4,SR 1.5,SR 1.6,SR 1.7,SR 1.8,SR 1.9,SR 2.1,SR 2.2,SR 2.3,SR 2.4,SR 2.5,SR 2.6,SR 2.7'
    iso27001-2013: A.6.1.2,A.7.1.1,A.9.1.2,A.9.2.1,A.9.2.3,A.9.4.1,A.9.4.4,A.9.4.5
    nist: SC-2(1),CM-6(a)
    nist-csf: PR.AC-4,PR.AC-6,PR.PT-3
    srg: SRG-OS-000480-GPOS-00227

ocil_clause: 'Interactive boot is enabled at boot time'

ocil: |-
    Inspect <tt>/etc/default/grub</tt> for any instances of
    <tt>systemd.confirm_spawn=(1|yes|true|on)</tt> in the kernel boot arguments.
    Presence of a <tt>systemd.confirm_spawn=(1|yes|true|on)</tt> indicates
    that interactive boot is enabled at boot time and verify that
    <tt>GRUB_DISABLE_RECOVERY=true</tt> to disable recovery boot.

platform: grub2
