STIGQter STIGQter: STIG Summary: Solaris 10 X86 Security Technical Implementation Guide Version: 2 Release: 2 Benchmark Date: 22 Jan 2021:

The system's boot loader configuration files must be owned by root.

DISA Rule

SV-220128r603266_rule

Vulnerability Number

V-220128

Group Title

SRG-OS-000480

Rule Version

GEN008760

Severity

CAT II

CCI(s)

Weight

10

Fix Recommendation

Change the ownership of the file.
# chown root /pool-name/boot/grub/menu.lst
or
# chown root /boot/grub/menu.lst

Check Contents

This check applies to the global zone only. Determine the type of zone that you are currently securing.

# zonename

If the command output is "global", this check applies.

On systems that have a ZFS root, the active menu.lst file is typically located at /pool-name/boot/grub/menu.lst where "pool-name" is the mount point for the top-level dataset.

On systems that have a UFS root, the active menu.lst file is typically located at /boot/grub/menu.lst. To locate the active GRUB menu, use the bootadm command with the list-menu option:

# bootadm list-menu

Check the ownership of the menu.lst file.

Procedure:
# ls -lL /pool-name/boot/grub/menu.lst
or
# ls -lL /boot/grub/menu.lst

If the owner of the file is not root, this is a finding.

Vulnerability Number

V-220128

Documentable

False

Rule Version

GEN008760

Severity Override Guidance

This check applies to the global zone only. Determine the type of zone that you are currently securing.

# zonename

If the command output is "global", this check applies.

On systems that have a ZFS root, the active menu.lst file is typically located at /pool-name/boot/grub/menu.lst where "pool-name" is the mount point for the top-level dataset.

On systems that have a UFS root, the active menu.lst file is typically located at /boot/grub/menu.lst. To locate the active GRUB menu, use the bootadm command with the list-menu option:

# bootadm list-menu

Check the ownership of the menu.lst file.

Procedure:
# ls -lL /pool-name/boot/grub/menu.lst
or
# ls -lL /boot/grub/menu.lst

If the owner of the file is not root, this is a finding.

Check Content Reference

M

Target Key

4061

Comments