Uninstall setroubleshoot-server Package
Ensures the setroubleshoot-server package is not installed, so the SETroubleshoot SELinux notification daemon never runs on the host.
Checked against what is installed or registered, packages present/absent, account databases.
A mapping is a cross-reference to where each standard places this requirement, anchored and cross-validated, not a claim of equivalence. A passing check is evidence toward these references, how to read it.
Why this rule matters
The SETroubleshoot daemon (setroubleshootd) analyzes SELinux AVC denials and surfaces desktop notifications. It is a workstation convenience tool with no place on a server: it runs a long-lived service, parses untrusted log data, and enlarges the attack surface for no operational benefit. Removing the package eliminates an unnecessary daemon and aligns the host with the principle of running only the software you actually need.
What Pavois checks
Pavois queries the package database through CINC/InSpec's package resource and asserts the package is absent. Unlike checks that grep config files, this reflects the effective installed state reported by dpkg/rpm, the same source the service manager uses to decide whether setroubleshootd can start.
describe package('setroubleshoot-server') do
it { should_not be_installed }
endHow to verify it is applied
Confirm the package is gone:
- Debian/Ubuntu:
dpkg -s setroubleshoot-serverreturnspackage ... is not installed. - RHEL/Alma:
rpm -q setroubleshoot-serverreturnspackage setroubleshoot-server is not installed.
Inspect & investigate
- Package removal is recorded in
/var/log/dpkg.log(Debian/Ubuntu) or viarpm -q --last setroubleshoot-serverand/var/log/dnf.log(RHEL). - If the service was running,
systemctl status setroubleshootdshould now report not-found / inactive.
Remediation
Pavois's harden plan declares a package resource for setroubleshoot-server with action remove, so running pavois harden apply uninstalls it via the native package manager (apt/dnf). No service restart is needed; the daemon simply stops existing.
Pavois applies this with its own harden engine, the plan below, not a shell script:
| action | remove |
|---|---|
| name | setroubleshoot-server |
| resource | package |
pavois harden plan localwhere the target is local, a user@host SSH alias, or a container , Docs
Impact & precautions
Impact is minimal on a server: you lose graphical SELinux denial notifications, which are irrelevant headless. Before applying, confirm no admin workflow relies on the sealert GUI to triage AVC denials, you can still inspect denials with ausearch -m avc or journalctl. Removing it does not disable SELinux enforcement itself.
Standards mapping
| Standard | Reference | Type | Version | Confidence |
|---|---|---|---|---|
| ANSSI BP-028 | R49 | direct | 2.0 | high |
Each reference is a cross-reference anchored in the upstream benchmark and cross-validated against the SCAP Security Guide and ansible-lockdown, not a claim of equivalence. Direct = a prescriptive, line-level requirement; supporting = an abstract control family (NIST) the check provides evidence toward. How to read a mapping.