Uninstall the setroubleshoot Package
Ensures the setroubleshoot package (SELinux troubleshooting daemon) is not installed.
Checked against what is installed or registered, packages present/absent, account databases.
A mapping is a cross-reference to where each standard places this requirement, anchored and cross-validated, not a claim of equivalence. A passing check is evidence toward these references, how to read it.
Why this rule matters
The setroubleshoot daemon interprets SELinux AVC denials and raises desktop notifications to help diagnose policy problems. It is a GUI-oriented helper that is unnecessary on a headless server, especially where X Windows is removed or disabled. Running it adds an extra daemon and attack surface for no operational benefit, so it should be removed (ANSSI R49, CIS 1.3.1.8).
What Pavois checks
Pavois queries the package database with describe package('setroubleshoot') and asserts it should_not be_installed, reflecting the real installed state rather than checking for the daemon's files on disk.
describe package('setroubleshoot') do
it { should_not be_installed }
endHow to verify it is applied
RPM: rpm -q setroubleshoot → package setroubleshoot is not installed. Debian/Ubuntu: dpkg -s setroubleshoot → package 'setroubleshoot' is not installed.
Inspect & investigate
Removal is recorded by the package manager: dnf history / /var/log/dnf.rpm.log (RPM) or /var/log/dpkg.log (Debian/Ubuntu); filter with grep setroubleshoot. SELinux denials themselves remain in /var/log/audit/audit.log (type=AVC). Confirm state with rpm -q setroubleshoot.
Remediation
Pavois's harden plan removes the setroubleshoot package (resource package, action remove). Apply it with pavois harden apply.
Pavois applies this with its own harden engine, the plan below, not a shell script:
| action | remove |
|---|---|
| name | setroubleshoot |
| resource | package |
pavois harden plan localwhere the target is local, a user@host SSH alias, or a container , Docs
Impact & precautions
Removing setroubleshoot only disables the friendly SELinux notification/analysis helper; SELinux enforcement and AVC auditing are unaffected, so there is no availability or lockout risk. Administrators lose sealert convenience but can still analyse raw denials in /var/log/audit/audit.log or with ausearch -m AVC.
Standards mapping
| Standard | Reference | Type | Version | Confidence |
|---|---|---|---|---|
| ANSSI BP-028 | R49 | direct | 2.0 | high |
| CIS | 1.3.1.8 | direct | per OS, see the benchmark table | high |
Each reference is a cross-reference anchored in the upstream benchmark and cross-validated against the SCAP Security Guide and ansible-lockdown, not a claim of equivalence. Direct = a prescriptive, line-level requirement; supporting = an abstract control family (NIST) the check provides evidence toward. How to read a mapping.