Uninstall iprutils Package
Ensures the iprutils IBM Power SCSI management package is not installed.
Checked against what is installed or registered, packages present/absent, account databases.
Why this rule matters
iprutils provides a suite of utilities to manage and configure SCSI devices supported by the IBM Power ipr SCSI storage device driver. On systems that do not use IBM Power RAID storage adapters the package is dead weight: it ships privileged management binaries (e.g. iprconfig) that needlessly widen the attack surface and provide an attacker with extra tooling. Removing it follows the principle of minimizing installed software.
What Pavois checks
Pavois asks the package manager directly via the InSpec package('iprutils') resource (rpm -q iprutils under the hood) and asserts it is not installed. Querying the live package database is authoritative: it reflects what is actually present on the running system, not what a manifest or kickstart file claims should be there.
describe package('iprutils') do
it { should_not be_installed }
endHow to verify it is applied
Run rpm -q iprutils. The expected output is package iprutils is not installed. A line such as iprutils-2.4.x-... means the package is still present and the rule fails.
Inspect & investigate
Package removal is recorded by the package manager: inspect dnf history (or rpm -q --last iprutils) to confirm when and by whom it was uninstalled. /var/log/dnf.log and /var/log/dnf.rpm.log also trace the transaction.
Remediation
Pavois's harden plan declares a package resource named iprutils with action remove, so pavois harden apply runs the equivalent of dnf remove iprutils to take the system to the compliant state. If remediation were empty you would remove it manually.
Pavois applies this with its own harden engine, the plan below, not a shell script:
| action | remove |
|---|---|
| name | iprutils |
| resource | package |
pavois harden plan localwhere the target is local, a user@host SSH alias, or a container , Docs
Impact & precautions
Leaving iprutils installed keeps unused privileged storage tooling on the host, enlarging the attack surface for no operational benefit. Precaution: before removing, confirm the system has no IBM Power ipr SCSI/RAID adapter in active use (lspci | grep -i raid, lsmod | grep ipr). On hardware that relies on these adapters, removing the package can leave the array unmanageable, keep it there and mark this rule as not applicable.