STIGQter STIGQter: STIG Summary: Red Hat Enterprise Linux 8 Security Technical Implementation Guide Version: 2 Release: 8 Benchmark Date: 01 Jul 2026:

RHEL 8 must cover or disable the built-in or attached camera when not in use.

DISA Rule

SV-230493r1184280_rule

Vulnerability Number

V-230493

Group Title

SRG-OS-000095-GPOS-00049

Rule Version

RHEL-08-040020

Severity

CAT II

CCI(s)

Weight

10

Fix Recommendation

Configure the operating system to disable the built-in or attached camera when not in use.

Add or update the followind lines in the "/etc/modprobe.d/blacklist.conf" file:

install uvcvideo /bin/false
blacklist uvcvideo

Reboot the system for the settings to take effect.

Check Contents

If the device or operating system does not have a camera installed, this is not applicable.

This requirement is not applicable to mobile devices (smartphones and tablets), where the use of the camera is a local authorizing official (AO) decision.

This requirement is not applicable to dedicated VTC suites located in approved VTC locations that are centrally managed.

For an external camera, if there is not a method for the operator to manually disconnect the camera at the end of collaborative computing sessions, this is a finding.

For a built-in camera, the camera must be protected by a camera cover (e.g., laptop camera cover slide) when not in use. If the built-in camera is not protected with a camera cover, or is not physically disabled, this is a finding.

If the camera is not disconnected, covered, or physically disabled, determine if it is being disabled via software.

Verify the operating system disables the ability to load the uvcvideo kernel module and ensure that the uvcvideo protocol module is disabled with the following command:

$ sudo grep -r uvcvideo /etc/modprobe.d/* | grep "blacklist"

/etc/modprobe.d/blacklist:install uvcvideo /bin/false
/etc/modprobe.d/blacklist:blacklist uvcvideo

If the command does not return uncommented output and the collaborative computing device has not been authorized for use, this is a finding.

Vulnerability Number

V-230493

Documentable

False

Rule Version

RHEL-08-040020

Severity Override Guidance

If the device or operating system does not have a camera installed, this is not applicable.

This requirement is not applicable to mobile devices (smartphones and tablets), where the use of the camera is a local authorizing official (AO) decision.

This requirement is not applicable to dedicated VTC suites located in approved VTC locations that are centrally managed.

For an external camera, if there is not a method for the operator to manually disconnect the camera at the end of collaborative computing sessions, this is a finding.

For a built-in camera, the camera must be protected by a camera cover (e.g., laptop camera cover slide) when not in use. If the built-in camera is not protected with a camera cover, or is not physically disabled, this is a finding.

If the camera is not disconnected, covered, or physically disabled, determine if it is being disabled via software.

Verify the operating system disables the ability to load the uvcvideo kernel module and ensure that the uvcvideo protocol module is disabled with the following command:

$ sudo grep -r uvcvideo /etc/modprobe.d/* | grep "blacklist"

/etc/modprobe.d/blacklist:install uvcvideo /bin/false
/etc/modprobe.d/blacklist:blacklist uvcvideo

If the command does not return uncommented output and the collaborative computing device has not been authorized for use, this is a finding.

Check Content Reference

M

Target Key

2921