Uninstall the setroubleshoot-plugins Package
Ensures the setroubleshoot-plugins package (SETroubleshoot analysis plugins) is not installed.
Checked against what is installed or registered, packages present/absent, account databases.
A mapping is a cross-reference to where each standard places this requirement, anchored and cross-validated, not a claim of equivalence. A passing check is evidence toward these references, how to read it.
Why this rule matters
The setroubleshoot-plugins package supplies the analysis plugins for the SETroubleshoot daemon, which interprets SELinux AVC denials and surfaces desktop notifications. This troubleshooting helper is unnecessary on a server, adds attack surface, and runs code analysing security-relevant events outside the core SELinux path. Removing it (alongside setroubleshoot) keeps the server minimal and aligned with the principle of installing only required software (ANSSI R49).
What Pavois checks
Pavois queries the package database with describe package('setroubleshoot-plugins') and asserts it should_not be_installed, reflecting the real installed state rather than scanning for plugin files on disk.
describe package('setroubleshoot-plugins') do
it { should_not be_installed }
endHow to verify it is applied
RPM: rpm -q setroubleshoot-plugins → package setroubleshoot-plugins is not installed. Debian/Ubuntu: dpkg -s setroubleshoot-plugins → package 'setroubleshoot-plugins' is not installed.
Inspect & investigate
Removal is recorded by the package manager: dnf history / /var/log/dnf.rpm.log (RPM) or /var/log/dpkg.log (Debian/Ubuntu); filter with grep setroubleshoot. SELinux denials themselves are logged in /var/log/audit/audit.log (type=AVC) independently of this package. Confirm state with rpm -q setroubleshoot-plugins.
Remediation
Pavois's harden plan removes the setroubleshoot-plugins package (resource package, action remove). Apply it with pavois harden apply.
Pavois applies this with its own harden engine, the plan below, not a shell script:
| action | remove |
|---|---|
| name | setroubleshoot-plugins |
| resource | package |
pavois harden plan localwhere the target is local, a user@host SSH alias, or a container , Docs
Impact & precautions
Removing the plugins only disables SELinux troubleshooting notifications; SELinux enforcement and AVC auditing are unaffected. There is no service-availability or lockout risk. On an administered server you lose the friendly sealert analysis, but raw denials remain in /var/log/audit/audit.log for diagnosis.
Standards mapping
| Standard | Reference | Type | Version | Confidence |
|---|---|---|---|---|
| ANSSI BP-028 | R49 | direct | 2.0 | high |
Each reference is a cross-reference anchored in the upstream benchmark and cross-validated against the SCAP Security Guide and ansible-lockdown, not a claim of equivalence. Direct = a prescriptive, line-level requirement; supporting = an abstract control family (NIST) the check provides evidence toward. How to read a mapping.