Uninstall tuned Package
Ensures the tuned dynamic system-tuning package is not installed.
Checked against what is installed or registered, packages present/absent, account databases.
Why this rule matters
tuned ships a daemon that dynamically tunes system settings by periodically monitoring several components and switching them between lower or higher power-saving profiles. On a hardened server this daemon is rarely required: it is an extra always-running service with privileged access to kernel knobs (sysctl, CPU governor, disk schedulers), which enlarges the attack surface and can silently override security-relevant kernel parameters. If tuned is not part of your performance baseline, removing the package eliminates the daemon and the risk of its accidental or malicious activation.
What Pavois checks
Pavois asks the package manager whether tuned is present via the InSpec package('tuned') resource (backed by rpm -q tuned). Querying the package database rather than guessing from running processes is what guarantees the daemon cannot be restarted later: as long as the package is gone, the tuned.service unit no longer exists.
describe package('tuned') do
it { should_not be_installed }
endHow to verify it is applied
Run rpm -q tuned. Expected output: package tuned is not installed. You can also confirm the unit is gone with systemctl status tuned returning Unit tuned.service could not be found.
Inspect & investigate
- Package state:
rpm -q tunedand the transaction history indnf history(/var/log/dnf.rpm.log). - Past daemon activity (before removal):
journalctl -u tuned.
Remediation
Pavois's harden plan declares a package resource for tuned with action remove, so pavois harden apply uninstalls the package (dnf remove tuned). No service restart is needed, removing the package also removes the unit. If you rely on a specific tuned profile for performance, do not apply this rule.
Pavois applies this with its own harden engine, the plan below, not a shell script:
| action | remove |
|---|---|
| name | tuned |
| resource | package |
pavois harden plan localwhere the target is local, a user@host SSH alias, or a container , Docs
Impact & precautions
If tuned stays installed, an unnecessary privileged daemon keeps running and may override kernel/CPU/disk settings, including security-relevant sysctl values, and remains exploitable surface. Before applying: confirm no performance SLA depends on a tuned profile (check tuned-adm active); on virtualization hosts or latency-sensitive workloads a tuned profile may be intentional. Removal is non-disruptive to networking or login, so there is no lockout risk, but power/performance characteristics may revert to kernel defaults.