documentation_complete: true

title: 'Disable kernel support for MISC binaries'

description: |-
    Enabling <tt>CONFIG_BINFMT_MISC</tt> makes it possible to plug wrapper-driven binary formats
    into the kernel. This is specially useful for programs that need an interpreter to run like
    Java, Python and DOS emulators. Once you have registered such a binary class with the kernel,
    you can start one of those programs simply by typing in its name at a shell prompt.

    {{{ describe_kernel_build_config("CONFIG_BINFMT_MISC", "n") | indent(4) }}}

rationale: |-
    This disables arbitrary binary format support and helps reduce attack surface.

warnings:
    {{{ warning_kernel_build_config() | indent(4) }}}

severity: medium

identifiers:
    cce@rhel8: CCE-87766-2
    cce@rhel9: CCE-87767-0
    cce@rhel10: CCE-87210-1

ocil_clause: 'the kernel was not built with the required value'

ocil: |-
    {{{ ocil_kernel_build_config("CONFIG_BINFMT_MISC", "n") | indent(4) }}}

template:
    name: kernel_build_config
    vars:
        config: CONFIG_BINFMT_MISC
        value: 'n'

