Disable Odd Job Daemon (oddjobd)

Classification:

compliance

Framework:

Control:

Description

The oddjobd service exists to provide an interface and access control mechanism through which specified privileged tasks can run tasks for unprivileged client applications. Communication with oddjobd through the system message bus.

The oddjobd service can be disabled with the following command:

$ sudo systemctl disable oddjobd.service

Rationale

The oddjobd service may provide necessary functionality in some environments, and can be disabled if it is not needed. Execution of tasks by privileged programs, on behalf of unprivileged ones, has traditionally been a source of privilege escalation security issues.

Remediation

Shell script

The following script can be run on the host to remediate the issue.

SYSTEMCTL\_EXEC='/usr/bin/systemctl'
"$SYSTEMCTL\_EXEC" stop 'oddjobd.service'
"$SYSTEMCTL\_EXEC" disable 'oddjobd.service'
# Disable socket activation if we have a unit file for it
"$SYSTEMCTL\_EXEC" list-unit-files | grep -q '^oddjobd.socket\>' && "$SYSTEMCTL\_EXEC" disable 'oddjobd.socket'
# The service may not be running because it has been started and failed,
# so let's reset the state so OVAL checks pass.
# Service should be 'inactive', not 'failed' after reboot though.
"$SYSTEMCTL\_EXEC" reset-failed 'oddjobd.service'

Ansible playbook

The following playbook can be run with Ansible to remediate the issue.

- name: Disable service oddjobd
 service:
 name: "{{item}}"
 enabled: "no"
 state: "stopped"
 register: service\_result
 failed\_when: "service\_result is failed and ('Could not find the requested service' not in service\_result.msg)"
 with\_items:
 - oddjobd
 tags:
 - service\_oddjobd\_disabled
 - unknown\_severity
 - disable\_strategy
 - low\_complexity
 - low\_disruption
 - NIST-800-53-CM-7


- name: Disable socket of service oddjobd if applicable
 service:
 name: "{{item}}"
 enabled: "no"
 state: "stopped"
 register: socket\_result
 failed\_when: "socket\_result is failed and ('Could not find the requested service' not in socket\_result.msg)"
 with\_items:
 - oddjobd.socket
 tags:
 - service\_oddjobd\_disabled
 - unknown\_severity
 - disable\_strategy
 - low\_complexity
 - low\_disruption
 - NIST-800-53-CM-7