Vulnerability Discussion

This requirement prevents attackers with physical access from easily bypassing security on the machine and gaining root access.

Such accesses are further prevented by configuring the bootloader password.

Check

Verify that AlmaLinux OS 9 requires authentication for emergency mode with the following command:

$ grep -E 'ExecStart.*sulogin' /usr/lib/systemd/system/emergency.service

ExecStart=-/usr/lib/systemd/systemd-sulogin-shell emergency

If this line is not returned, or is commented out, this is a finding.
If the output is different, this is a finding.

Fix

Configure AlmaLinux OS 9 to require authentication for emergency mode.

Add or modify the following line in the "/usr/lib/systemd/system/emergency.service" file:

ExecStart=-/usr/lib/systemd/systemd-sulogin-shell emergency

"sudo systemctl edit emergency.service" can also be used to create a "/etc/systemd/system/emergency.service.d/override.conf" file.