STIGQter: STIG Summary: Cloud Linux AlmaLinux OS 9 Security Technical Implementation Guide Version: 1 Release: 7 Benchmark Date: 01 Jul 2026:

AlmaLinux OS 9 must not show boot up messages.

DISA Rule

SV-269442r1050325_rule

Vulnerability Number

V-269442

Group Title

SRG-OS-000206-GPOS-00084

Rule Version

ALMA-09-043800

Severity

CAT II

CCI(s)

• CCI-001314 - Reveal error messages only to organization-defined personnel or roles.

Weight

10

Fix Recommendation

Configure the grub bootloader to use the "quiet" parameter using the following command:

$ grubby --update-kernel=ALL --args=quiet

Check Contents

Without using the "quiet" grub kernel parameter, the hardware and service information are printed to the console on boot and sometimes afterwards. This information could be useful for attackers with physical access, or so-called "shoulder surfers".

Boot failures will still be shown, as will the LUKS password prompt.

Verify the grub bootloader has the "quiet" option set with the following command:

$ grubby --info=ALL | grep quiet

args="ro audit=1 audit_backlog_limit=8192 page_poison=1 vsyscall=none slub_debug=P pti=on iommu=force resume=/dev/mapper/luks-89bf0df8-547f-4613-af07-215e5f62e9a9 rd.luks.uuid=luks-8a7154ec-8eeb-46c8-9d75-66fc4b80d665 rd.lvm.lv=rootvg/root rd.luks.uuid=luks-89bf0df8-547f-4613-af07-215e5f62e9a9 rd.lvm.lv=rootvg/swap rd.shell=0 quiet splash fips=1 boot=UUID=eda01e9b-b7e1-431b-9549-16d5dcddf665 selinux=1 enforcing=1"

args="ro audit=1 audit_backlog_limit=8192 page_poison=1 vsyscall=none slub_debug=P pti=on iommu=force resume=/dev/mapper/luks-89bf0df8-547f-4613-af07-215e5f62e9a9 rd.luks.uuid=luks-8a7154ec-8eeb-46c8-9d75-66fc4b80d665 rd.lvm.lv=rootvg/root rd.luks.uuid=luks-89bf0df8-547f-4613-af07-215e5f62e9a9 rd.lvm.lv=rootvg/swap rd.shell=0 quiet splash fips=1 boot=UUID=eda01e9b-b7e1-431b-9549-16d5dcddf665 selinux=1 enforcing=1"

If nothing is returned, this is a finding.

Vulnerability Number

V-269442

Documentable

False

Rule Version

ALMA-09-043800

Severity Override Guidance

Without using the "quiet" grub kernel parameter, the hardware and service information are printed to the console on boot and sometimes afterwards. This information could be useful for attackers with physical access, or so-called "shoulder surfers".

Boot failures will still be shown, as will the LUKS password prompt.

Verify the grub bootloader has the "quiet" option set with the following command:

$ grubby --info=ALL | grep quiet

args="ro audit=1 audit_backlog_limit=8192 page_poison=1 vsyscall=none slub_debug=P pti=on iommu=force resume=/dev/mapper/luks-89bf0df8-547f-4613-af07-215e5f62e9a9 rd.luks.uuid=luks-8a7154ec-8eeb-46c8-9d75-66fc4b80d665 rd.lvm.lv=rootvg/root rd.luks.uuid=luks-89bf0df8-547f-4613-af07-215e5f62e9a9 rd.lvm.lv=rootvg/swap rd.shell=0 quiet splash fips=1 boot=UUID=eda01e9b-b7e1-431b-9549-16d5dcddf665 selinux=1 enforcing=1"

args="ro audit=1 audit_backlog_limit=8192 page_poison=1 vsyscall=none slub_debug=P pti=on iommu=force resume=/dev/mapper/luks-89bf0df8-547f-4613-af07-215e5f62e9a9 rd.luks.uuid=luks-8a7154ec-8eeb-46c8-9d75-66fc4b80d665 rd.lvm.lv=rootvg/root rd.luks.uuid=luks-89bf0df8-547f-4613-af07-215e5f62e9a9 rd.lvm.lv=rootvg/swap rd.shell=0 quiet splash fips=1 boot=UUID=eda01e9b-b7e1-431b-9549-16d5dcddf665 selinux=1 enforcing=1"

If nothing is returned, this is a finding.

Check Content Reference

M

Target Key

5664