STIGQter STIGQter: STIG Summary: Solaris 10 X86 Security Technical Implementation Guide Version: 2 Release: 2 Benchmark Date: 22 Jan 2021:

The system's boot loader configuration file(s) must be group-owned by root, bin, sys, or system.

DISA Rule

SV-220129r603266_rule

Vulnerability Number

V-220129

Group Title

SRG-OS-000480

Rule Version

GEN008780

Severity

CAT II

CCI(s)

Weight

10

Fix Recommendation

Change the group ownership of the file.
# chgrp root /pool-name/boot/grub/menu.lst
or
# chgrp root /boot/grub/menu.lst

Check Contents

This check applies to the global zone only. Determine the type of zone that you are currently securing.

# zonename

If the command output is "global", this check applies.

On systems that have a ZFS root, the active menu.lst file is typically located at /pool-name/boot/grub/menu.lst where "pool-name" is the mount point for the top-level dataset.

On systems that have a UFS root, the active menu.lst file is typically located at /boot/grub/menu.lst. To locate the active GRUB menu, use the bootadm command with the list-menu option:

# bootadm list-menu

Check the group ownership of the menu.lst file.

Procedure:
# ls -lL /pool-name/boot/grub/menu.lst
or
# ls -lL /boot/grub/menu.lst

If the group owner of the file is not root, bin, sys, or system this is a finding.

Vulnerability Number

V-220129

Documentable

False

Rule Version

GEN008780

Severity Override Guidance

This check applies to the global zone only. Determine the type of zone that you are currently securing.

# zonename

If the command output is "global", this check applies.

On systems that have a ZFS root, the active menu.lst file is typically located at /pool-name/boot/grub/menu.lst where "pool-name" is the mount point for the top-level dataset.

On systems that have a UFS root, the active menu.lst file is typically located at /boot/grub/menu.lst. To locate the active GRUB menu, use the bootadm command with the list-menu option:

# bootadm list-menu

Check the group ownership of the menu.lst file.

Procedure:
# ls -lL /pool-name/boot/grub/menu.lst
or
# ls -lL /boot/grub/menu.lst

If the group owner of the file is not root, bin, sys, or system this is a finding.

Check Content Reference

M

Target Key

4061

Comments