STIGQter: STIG Summary: Solaris 11 X86 Security Technical Implementation Guide Version: 2 Release: 3 Benchmark Date: 23 Apr 2021:

The operator must document all file system objects that have non-standard access control list settings.

DISA Rule

SV-216204r603268_rule

Vulnerability Number

V-216204

Group Title

SRG-OS-000480

Rule Version

SOL-11.1-070260

Severity

CAT II

CCI(s)

• CCI-000366 - The organization implements the security configuration settings.

Weight

10

Fix Recommendation

The root role is required.

Remove ACLs that are not approved in the security policy.

For ZFS file systems, remove all extended ACLs with the following command:

# chmod A- [filename]

For UFS file systems

Determine the ACLs that are set on a file:

# getfacl [filename]

Remove any ACL configurations that are set:

# setfacl -d [ACL] [filename]

Check Contents

The root role is required.

Identify all file system objects that have non-standard access control lists enabled.

# find / \( -fstype nfs -o -fstype cachefs -o -fstype autofs \
-o -fstype ctfs -o -fstype mntfs -o -fstype objfs \
-o -fstype proc \) -prune -o -acl -ls

This command should return no output. If output is created, this is a finding.

If the files are approved to have ACLs by organizational security policy, document the files and the reason that ACLs are required.

Vulnerability Number

V-216204

Documentable

False

Rule Version

SOL-11.1-070260

Severity Override Guidance

The root role is required.

Identify all file system objects that have non-standard access control lists enabled.

# find / \( -fstype nfs -o -fstype cachefs -o -fstype autofs \
-o -fstype ctfs -o -fstype mntfs -o -fstype objfs \
-o -fstype proc \) -prune -o -acl -ls

This command should return no output. If output is created, this is a finding.

If the files are approved to have ACLs by organizational security policy, document the files and the reason that ACLs are required.

Check Content Reference

M

Target Key

4021

Comments