documentation_complete: true


title: 'Disable Kernel Support for USB via Bootloader Configuration'

description: |-
    All USB support can be disabled by adding the <tt>nousb</tt>
    argument to the kernel's boot loader configuration. To do so,
    add the argument <tt>nousb</tt> to the default
    GRUB 2 command line for the Linux operating system.
    {{{ describe_grub2_argument("nousb") | indent(4) }}}

rationale: |-
    Disabling the USB subsystem within the Linux kernel at system boot will
    protect against potentially malicious USB devices, although it is only practical
    in specialized systems.

severity: unknown

identifiers:
    cce@rhcos4: CCE-82661-0
    cce@rhel9: CCE-89568-0
    cce@rhel10: CCE-88814-9

references:
    cis-csc: 12,16
    cobit5: APO13.01,DSS01.04,DSS05.03,DSS05.04,DSS05.05,DSS05.07,DSS06.03
    hipaa: 164.308(a)(3)(i),164.308(a)(3)(ii)(A),164.310(d)(1),164.310(d)(2),164.312(a)(1),164.312(a)(2)(iv),164.312(b)
    isa-62443-2009: 4.3.3.2.2,4.3.3.5.2,4.3.3.6.6,4.3.3.7.2,4.3.3.7.4
    isa-62443-2013: 'SR 1.1,SR 1.13,SR 1.2,SR 1.4,SR 1.5,SR 1.9,SR 2.1,SR 2.6'
    iso27001-2013: A.11.2.6,A.13.1.1,A.13.2.1,A.6.2.1,A.6.2.2,A.7.1.1,A.9.2.1
    nist: MP-7,CM-6(a)
    nist-csf: PR.AC-3,PR.AC-6

warnings:
    - functionality: |-
        Disabling all kernel support for USB will cause problems for systems
        with USB-based keyboards, mice, or printers. This configuration is
        infeasible for systems which require USB devices, which is common.

platform: grub2

template:
    name: grub2_bootloader_argument
    vars:
        arg_name: nousb

ocil_clause: 'usb is enabled at boot time'

ocil: |-
    {{{ ocil_grub2_argument("nousb") | indent(4) }}}
