Disable Odd Job Daemon (oddjobd)
Description
The oddjobd service exists to provide an interface and
access control mechanism through which
specified privileged tasks can run tasks for unprivileged client
applications. Communication with oddjobd through the system message bus.
The oddjobd service can be disabled with the following command:
$ sudo systemctl disable oddjobd.service
Rationale
The oddjobd service may provide necessary functionality in
some environments, and can be disabled if it is not needed. Execution of
tasks by privileged programs, on behalf of unprivileged ones, has traditionally
been a source of privilege escalation security issues.
Shell script
The following script can be run on the host to remediate the issue.
SYSTEMCTL\_EXEC='/usr/bin/systemctl'
"$SYSTEMCTL\_EXEC" stop 'oddjobd.service'
"$SYSTEMCTL\_EXEC" disable 'oddjobd.service'
# Disable socket activation if we have a unit file for it
"$SYSTEMCTL\_EXEC" list-unit-files | grep -q '^oddjobd.socket\>' && "$SYSTEMCTL\_EXEC" disable 'oddjobd.socket'
# The service may not be running because it has been started and failed,
# so let's reset the state so OVAL checks pass.
# Service should be 'inactive', not 'failed' after reboot though.
"$SYSTEMCTL\_EXEC" reset-failed 'oddjobd.service'
Ansible playbook
The following playbook can be run with Ansible to remediate the issue.
- name: Disable service oddjobd
service:
name: "{{item}}"
enabled: "no"
state: "stopped"
register: service\_result
failed\_when: "service\_result is failed and ('Could not find the requested service' not in service\_result.msg)"
with\_items:
- oddjobd
tags:
- service\_oddjobd\_disabled
- unknown\_severity
- disable\_strategy
- low\_complexity
- low\_disruption
- NIST-800-53-CM-7
- name: Disable socket of service oddjobd if applicable
service:
name: "{{item}}"
enabled: "no"
state: "stopped"
register: socket\_result
failed\_when: "socket\_result is failed and ('Could not find the requested service' not in socket\_result.msg)"
with\_items:
- oddjobd.socket
tags:
- service\_oddjobd\_disabled
- unknown\_severity
- disable\_strategy
- low\_complexity
- low\_disruption
- NIST-800-53-CM-7
