Uninstall mcstrans Package
Removes the mcstrans package (SELinux label-translation daemon), which is unneeded on virtually all systems.
Checked against what is installed or registered, packages present/absent, account databases.
A mapping is a cross-reference to where each standard places this requirement, anchored and cross-validated, not a claim of equivalence. A passing check is evidence toward these references, how to read it.
Why this rule matters
The mcstrans package provides the mcstransd daemon, which translates SELinux MCS/MLS sensitivity labels into human-readable form. It is only useful on systems that actually use multi-level/multi-category security, which is rare. Because it runs as a daemon that few environments need, removing it reduces the amount of potentially vulnerable, unmonitored code running on the host and shrinks the attack surface.
What Pavois checks
Pavois queries the package database through the InSpec package('mcstrans') resource and asserts should_not be_installed, resolving via dpkg/rpm. This is the effective state: the only reliable test of whether the mcstransd daemon code is present is the package inventory itself, not the presence or absence of a running process (which can be stopped yet still installed and re-startable).
describe package('mcstrans') do
it { should_not be_installed }
endHow to verify it is applied
RHEL: rpm -q mcstrans should print package mcstrans is not installed. Debian/Ubuntu: dpkg -s mcstrans should report not installed. Confirm no daemon is running with systemctl status mcstransd (expect not-found/inactive).
Inspect & investigate
Removal is recorded in /var/log/dpkg.log (Debian/Ubuntu) or dnf history (RHEL). Any prior mcstransd activity would have appeared in journalctl -u mcstransd; after removal there should be no such unit.
Remediation
Pavois's harden plan declares a package resource for mcstrans with action remove; pavois harden apply uninstalls it via the native package manager (apt/dnf). Removing the package also disables mcstransd. This does not affect SELinux enforcement itself, only the optional human-readable translation of MCS/MLS labels.
Pavois applies this with its own harden engine, the plan below, not a shell script:
| action | remove |
|---|---|
| name | mcstrans |
| resource | package |
pavois harden plan localwhere the target is local, a user@host SSH alias, or a container , Docs
Impact & precautions
Removing mcstrans is safe on standard systems: SELinux enforcement is unaffected and only the cosmetic translation of sensitivity labels is lost. Precautions: if you operate a genuine MLS/MCS deployment where administrators read translated labels (e.g. via chcat workflows), keep the package, as raw labels become harder to interpret. On Debian/Ubuntu the package is usually absent anyway, so the rule is typically already satisfied.
Standards mapping
| Standard | Reference | Type | Version | Confidence |
|---|---|---|---|---|
| CIS | 1.3.1.7 | direct | per OS, see the benchmark table | high |
Each reference is a cross-reference anchored in the upstream benchmark and cross-validated against the SCAP Security Guide and ansible-lockdown, not a claim of equivalence. Direct = a prescriptive, line-level requirement; supporting = an abstract control family (NIST) the check provides evidence toward. How to read a mapping.