documentation_complete: true

prodtype: rhel7

title: 'Boat Loader Is Not Installed On Removeable Media'

description: |-
    The system must not allow removable media to be used as the boot loader.
    Remove alternate methods of booting the system from removable media.
    <tt>usb0</tt>, <tt>cd</tt>, <tt>fd0</tt>, etc. are some examples of removeable
    media which should not exist in the line:
    <pre>set root='hd0,msdos1'</pre>

rationale: |-
    Malicious users with removable boot media can gain access to a system
    configured to use removable media as the boot loader.

severity: medium

identifiers:
    cce: 80517-6

references:
    disa: 1814
    nist: ""
    srg: SRG-OS-000364-GPOS-00151
    stigid: "021700"

ocil_clause: 'it is not'

ocil: |-
    To verify the system is not configured to use a boot loader on removable media,
    run the following command:
    <pre>$ sudo grep "set root='hd0" /boot/grub2/grub.cfg</pre>
    The output should return something similar to:
    <pre>set root='hd0,msdos1'</pre>
    <tt>usb0</tt>, <tt>cd</tt>, <tt>fd0</tt>, etc. are some examples of removeable
    media which should not exist in the line:
    <pre>set root='hd0,msdos1'</pre>
