documentation_complete: true


title: 'Require Authentication for Emergency Systemd Target'

description: |-
    Emergency mode is intended as a system recovery
    method, providing a single user root access to the system
    during a failed boot sequence.
    <br /><br />
    By default, Emergency mode is protected by requiring a password and is set
    in <tt>/usr/lib/systemd/system/emergency.service</tt>.

rationale: |-
    This prevents attackers with physical access from trivially bypassing security
    on the machine and gaining root access. Such accesses are further prevented
    by configuring the bootloader password.

severity: medium

identifiers:
    cce@rhel8: CCE-82186-8
    cce@rhel9: CCE-83592-6
    cce@rhel10: CCE-89188-7
    cce@sle12: CCE-92223-7
    cce@sle15: CCE-91347-5
    cce@sle16: CCE-96670-5
    cce@slmicro5: CCE-94049-4

references:
    cis-csc: 1,11,12,14,15,16,18,3,5
    cis@sle12: 1.5.3
    cis@sle15: 1.5.3
    cobit5: DSS05.02,DSS05.04,DSS05.05,DSS05.07,DSS05.10,DSS06.03,DSS06.06,DSS06.10
    cui: 3.1.1,3.4.5
    hipaa: 164.308(a)(1)(ii)(B),164.308(a)(7)(i),164.308(a)(7)(ii)(A),164.310(a)(1),164.310(a)(2)(i),164.310(a)(2)(ii),164.310(a)(2)(iii),164.310(b),164.310(c),164.310(d)(1),164.310(d)(2)(iii)
    isa-62443-2009: 4.3.3.2.2,4.3.3.5.1,4.3.3.5.2,4.3.3.5.3,4.3.3.5.4,4.3.3.5.5,4.3.3.5.6,4.3.3.5.7,4.3.3.5.8,4.3.3.6.1,4.3.3.6.2,4.3.3.6.3,4.3.3.6.4,4.3.3.6.5,4.3.3.6.6,4.3.3.6.7,4.3.3.6.8,4.3.3.6.9,4.3.3.7.1,4.3.3.7.2,4.3.3.7.3,4.3.3.7.4
    isa-62443-2013: 'SR 1.1,SR 1.10,SR 1.11,SR 1.12,SR 1.13,SR 1.2,SR 1.3,SR 1.4,SR 1.5,SR 1.6,SR 1.7,SR 1.8,SR 1.9,SR 2.1,SR 2.2,SR 2.3,SR 2.4,SR 2.5,SR 2.6,SR 2.7'
    iso27001-2013: A.18.1.4,A.6.1.2,A.7.1.1,A.9.1.2,A.9.2.1,A.9.2.2,A.9.2.3,A.9.2.4,A.9.2.6,A.9.3.1,A.9.4.1,A.9.4.2,A.9.4.3,A.9.4.4,A.9.4.5
    nist: IA-2,AC-3,CM-6(a)
    nist-csf: PR.AC-1,PR.AC-4,PR.AC-6,PR.AC-7,PR.PT-3
    srg: SRG-OS-000080-GPOS-00048
    stigid@ol7: OL07-00-010481
    stigid@ol8: OL08-00-010152

ocil_clause: 'the output is different'

ocil: |-
    To check if authentication is required for emergency mode, run the following command:
    <pre>$ grep sulogin /usr/lib/systemd/system/emergency.service</pre>
    The output should be similar to the following, and the line must begin with
    {{% if product in ["fedora", "ol8", "ol9", "rhel8", "rhel9", "sle12", "sle15", "sle16", "slmicro5"] -%}}
        ExecStart and /usr/lib/systemd/systemd-sulogin-shell.
        <pre>ExecStart=-/usr/lib/systemd/systemd-sulogin-shell emergency</pre>
    {{%- else -%}}
        ExecStart and /sbin/sulogin.
        <pre>ExecStart=-/bin/sh -c "/sbin/sulogin; /usr/bin/systemctl --fail --no-block default"</pre>
    {{%- endif %}}

    Then, check if the emergency target requires the emergency service:
    Run the following command:
    <pre>$ sudo grep Requires /usr/lib/systemd/system/emergency.target</pre>
    The output should be the following:
    <pre>Requires=emergency.service</pre>

    Then, check if there is no custom emergency target configured in systemd configuration.
    Run the following command:
    <pre>$ sudo grep -r emergency.target /etc/systemd/system/</pre>
    The output should be empty.

    Then, check if there is no custom emergency service configured in systemd configuration.
    Run the following command:
    <pre>$ sudo grep -r emergency.service /etc/systemd/system/</pre>
    The output should be empty.

fixtext: |-
    Configure {{{ full_name }}} to require authentication for system emergency mode.

    Add or edit the following line in "/usr/lib/systemd/system/emergency.service":
    {{% if product in ["fedora", "ol8", "ol9", "kylinserver10", "openeuler2203", "rhel8", "rhel9", "sle12", "sle15", "sle16", "slmicro5"] -%}}
    ExecStart=-/usr/lib/systemd/systemd-sulogin-shell emergency
    {{%- else -%}}
    ExecStart=-/bin/sh -c "/sbin/sulogin; /usr/bin/systemctl --fail --no-block default"
    {{%- endif %}}

srg_requirement: '{{{ full_name }}} must require authentication upon booting into emergency mode.'
