Remove the X Windows Xwayland Package
Ensures the X11 compatibility server xorg-x11-server-Xwayland is not installed on headless hosts.
Checked against what is installed or registered, packages present/absent, account databases.
A mapping is a cross-reference to where each standard places this requirement, anchored and cross-validated, not a claim of equivalence. A passing check is evidence toward these references, how to read it.
Why this rule matters
Unnecessary service packages must not be installed in order to decrease the attack surface of the system. Xwayland is the X11 compatibility server that lets legacy X applications run under a Wayland session; it inherits the X Window System's long history of security vulnerabilities. Unless your organization specifically requires graphical access, remove it to reduce the potential attack surface.
What Pavois checks
Pavois queries the package database via the InSpec package('xorg-x11-server-Xwayland') resource (rpm -q). Checking the package is decisive: with Wayland desktops, Xwayland is the only path left for X11 apps, so its absence proves there is no X11 surface even on a Wayland-based system.
describe package('xorg-x11-server-Xwayland') do
it { should_not be_installed }
endHow to verify it is applied
Run rpm -q xorg-x11-server-Xwayland. Expected output: package xorg-x11-server-Xwayland is not installed.
Inspect & investigate
- Package state:
rpm -q xorg-x11-server-Xwayland; removal recorded in/var/log/dnf.rpm.log. - Default boot target:
systemctl get-default(should bemulti-user.targeton a headless host).
Remediation
Pavois's harden plan declares a package resource for xorg-x11-server-Xwayland with action remove, so pavois harden apply uninstalls it (dnf remove xorg-x11-server-Xwayland).
Pavois applies this with its own harden engine, the plan below, not a shell script:
| action | remove |
|---|---|
| name | xorg-x11-server-Xwayland |
| resource | package |
pavois harden plan localwhere the target is local, a user@host SSH alias, or a container , Docs
Impact & precautions
Removing Xwayland stops X11 (legacy) applications from running under a Wayland desktop and breaks X11 forwarding. Before applying: confirm the host is headless and that no admin runs X11-forwarded GUI tools, on a Wayland workstation, removing Xwayland will break any non-Wayland-native application. On a server this is harmless and desirable. No SSH lockout risk, as X11 is independent of the SSH login itself.
Standards mapping
| Standard | Reference | Type | Version | Confidence |
|---|---|---|---|---|
| CIS | 2.1.22 | direct | per OS, see the benchmark table | high |
Each reference is a cross-reference anchored in the upstream benchmark and cross-validated against the SCAP Security Guide and ansible-lockdown, not a claim of equivalence. Direct = a prescriptive, line-level requirement; supporting = an abstract control family (NIST) the check provides evidence toward. How to read a mapping.