The ESXi host must enforce the exclusive running of executables from approved VIBs.

Severity	Group ID	Group Title	Version	Rule ID	Date	STIG Version
medium	V-258798	SRG-OS-000480-VMM-002000	ESXI-80-000244	SV-258798r933455_rule	2023-10-11	1

Description
The "execInstalledOnly" advanced ESXi boot option, when set to TRUE, guarantees that the VMkernel executes only those binaries that have been packaged as part of a signed VIB. While this option is effective on its own, it can be further enhanced by telling the Secure Boot to check with the TPM to make sure that the boot process does not proceed unless this setting is enabled. This further protects against malicious offline changes to ESXi configuration to disable the "execInstalledOnly" option.

Description

The "execInstalledOnly" advanced ESXi boot option, when set to TRUE, guarantees that the VMkernel executes only those binaries that have been packaged as part of a signed VIB. While this option is effective on its own, it can be further enhanced by telling the Secure Boot to check with the TPM to make sure that the boot process does not proceed unless this setting is enabled. This further protects against malicious offline changes to ESXi configuration to disable the "execInstalledOnly" option.

ℹ️ Check
If the ESXi host does not have a compatible TPM, this finding is downgraded to a CAT III. From the vSphere Client, go to Hosts and Clusters. Select the ESXi Host >> Configure >> System >> Advanced System Settings. Select the "VMkernel.Boot.execInstalledOnly" value and verify that it is "true". or From a PowerCLI command prompt while connected to the ESXi host, run the following command: Get-VMHost \| Get-AdvancedSetting -Name VMkernel.Boot.execInstalledOnly If the "VMkernel.Boot.execInstalledOnly" setting is not "true", this is a finding.

ℹ️ Check

If the ESXi host does not have a compatible TPM, this finding is downgraded to a CAT III. From the vSphere Client, go to Hosts and Clusters. Select the ESXi Host >> Configure >> System >> Advanced System Settings. Select the "VMkernel.Boot.execInstalledOnly" value and verify that it is "true". or From a PowerCLI command prompt while connected to the ESXi host, run the following command: Get-VMHost | Get-AdvancedSetting -Name VMkernel.Boot.execInstalledOnly If the "VMkernel.Boot.execInstalledOnly" setting is not "true", this is a finding.

✔️ Fix
From the vSphere Client, go to Hosts and Clusters. Select the ESXi Host >> Configure >> System >> Advanced System Settings. Click "Edit". Select the "VMkernel.Boot.execInstalledOnly" value and configure it to "true". or From a PowerCLI command prompt while connected to the ESXi host, run the following command: Get-VMHost \| Get-AdvancedSetting -Name VMkernel.Boot.execInstalledOnly \| Set-AdvancedSetting -Value True

✔️ Fix

From the vSphere Client, go to Hosts and Clusters. Select the ESXi Host >> Configure >> System >> Advanced System Settings. Click "Edit". Select the "VMkernel.Boot.execInstalledOnly" value and configure it to "true". or From a PowerCLI command prompt while connected to the ESXi host, run the following command: Get-VMHost | Get-AdvancedSetting -Name VMkernel.Boot.execInstalledOnly | Set-AdvancedSetting -Value True