How to uninstall MCStrans
Multi-Category Security Translation Service (MCSTrans) daemon provides category label information to client processes requesting information. The label translations are defined in:
/etc/selinux/targeted/setrans.conf
Ensure the MCS Translation Service (mcstrans) is not installed
Audit:
Run the following command and verify mcstrans is not installed.
| # rpm -q mcstrans package mcstrans is not installed |
Setting: 1.5.1.7 Ensure the MCS Translation Service (mcstrans) is not installed
To uninstall, run the following command to uninstall mcstrans:
| # dnf remove mcstrans |
Setting: 1.6.1.8 Ensure the MCS Translation Service (mcstrans) is not installed
| # yum remove mcstrans |
MITRE ATT&CK Mappings
Techniques / Subtechniques – T1543, T1543.002
Tactics – TA0005
Mitigations
What is Multi-Category Security
Multi-Category Security (MCS) is a way to categorize data with improved security in SELinux (Security-Enhanced Linux), within Linux environments such as Red Hat 5 and CentOS. In environments where there is sensitive information, MCS is used to categorize the data in order to control who has access to files, folders and processes.
MCS categories are additional to standard user permissions found in Linux, giving administrators finer control over access restrictions.
What is MCStrans
Each MCS category is given a unique, complex alphanumeric label such as: “c0” and “c1023”, allowing them to be assigned to users who need access to that specific information. Multi-Catergory Security Translation converts these labels into more readable formats for system administrators such as “ProjectX”.
Why ensure MCStrans is not installed
Although MCStrans itself does not pose a security risk, it can open up a system to attacks, leading to a potential risk of system instability.
For example, due to an algorithmic complexity flaw, it can be exploited by local users to cause a denial-of-service (DoS) attack. This is done by sending a large range of sensitivity labels to the MCStrans service, overwhelming it, resulting in temporary downtime of the daemon.
Due to vulnerabilities such as these, it is recommended to uninstall MCStrans unless absolutely necessary to reduce possible attack vectors which could destabilize a system.
What is the difference between MCS and MLS
While MCS uses categories to control access to data, MLS (Multi-Level Security) restricts access using strict hierarchical levels. Both allow system administrators control over data access, however MCS allows more flexibility, allowing segments of data to be shared with users regardless of assignment level.
Continuous Mitigation
With thousands of security settings and services, and more being created every year, knowing which to activate and which to disable is only getting more complicated. By disabling or removing unnecessary services like mcstrans, administrators help minimize the system’s attack surface and improve stability, aligning with best practices to secure the server by limiting it to essential services only.
By disabling unnecessary services and enforcing strict access controls, server hardening improves system stability and minimizes performance overhead. This can help protect sensitive data, ensure regulatory compliance, and reduce the risk of downtime, ultimately creating a more secure and reliable infrastructure for applications and users.
