STIGQter: STIG Summary: IBM AIX 7.x Security Technical Implementation Guide Version: 2 Release: 2 Benchmark Date: 23 Apr 2021:

All library files must not have extended ACLs.

DISA Rule

SV-215326r508663_rule

Vulnerability Number

V-215326

Group Title

SRG-OS-000259-GPOS-00100

Rule Version

AIX7-00-003010

Severity

CAT II

CCI(s)

• CCI-001499 - The organization limits privileges to change software resident within software libraries.

Weight

10

Fix Recommendation

Remove the extended ACL(s) from the system library file(s) and disable extended permissions using the follow script:

find /usr/lib/security /usr/lib/methods/ -type f | while read file
do
aclget -o /tmp/111.acl $file > /dev/null 2>&1
if [ $? -eq 0 ]; then
grep -e "[[:space:]]enabled$" /tmp/111.acl > /dev/null 2>&1
if [ $? -eq 0 ]; then
echo "Removing ACL from "$file
cat /tmp/111.acl | head -n9 > /tmp/222.acl
echo " disabled" >> /tmp/222.acl
aclput -i /tmp/222.acl $file
fi
fi
done

Check Contents

The following system library directories need to be checked:
/usr/lib/security/
/usr/lib/methods/

Determine if any system library file has an extended ACL by running the follow script:

find /usr/lib/security /usr/lib/methods/ -type f | while read file
do
aclget -o /tmp/111.acl $file > /dev/null 2>&1
if [ $? -eq 0 ]; then
grep -e "[[:space:]]enabled$" /tmp/111.acl > /dev/null 2>&1
if [ $? -eq 0 ]; then
echo "$file has ACL"
fi
fi
done

If the above script yield any output, this is a finding.

Vulnerability Number

V-215326

Documentable

False

Rule Version

AIX7-00-003010

Severity Override Guidance

The following system library directories need to be checked:
/usr/lib/security/
/usr/lib/methods/

Determine if any system library file has an extended ACL by running the follow script:

find /usr/lib/security /usr/lib/methods/ -type f | while read file
do
aclget -o /tmp/111.acl $file > /dev/null 2>&1
if [ $? -eq 0 ]; then
grep -e "[[:space:]]enabled$" /tmp/111.acl > /dev/null 2>&1
if [ $? -eq 0 ]; then
echo "$file has ACL"
fi
fi
done

If the above script yield any output, this is a finding.

Check Content Reference

M

Target Key

4012

Comments