STIGQter STIGQter: STIG Summary: Solaris 10 X86 Security Technical Implementation Guide Version: 2 Release: 2 Benchmark Date: 22 Jan 2021:

The system's boot loader configuration file(s) must have mode 0600 or less permissive.

DISA Rule

SV-227985r603266_rule

Vulnerability Number

V-227985

Group Title

SRG-OS-000312

Rule Version

GEN008720

Severity

CAT II

CCI(s)

Weight

10

Fix Recommendation

Change the mode of the menu.lst file to 0600.

# chmod 0600 /pool-name/boot/grub/menu.lst
or
# chmod 0600 /boot/grub/menu.lst

Check Contents

This check applies to the global zone only. Determine the type of zone that you are currently securing.

# zonename

If the command output is "global", this check applies.

Check the permission of the menu.lst file.

On systems that have a ZFS root, the menu.lst file is typically located at /pool-name/boot/grub/menu.lst where "pool-name" is the mount point for the top-level dataset.

On systems that have a UFS root, the menu.lst file is typically located at /boot/grub/menu.lst .

Procedure:
# ls -lL /pool-name/boot/grub/menu.lst
or
# ls -lL /boot/grub/menu.lst

If menu.lst has a mode more permissive than 0600, this is a finding.

Vulnerability Number

V-227985

Documentable

False

Rule Version

GEN008720

Severity Override Guidance

This check applies to the global zone only. Determine the type of zone that you are currently securing.

# zonename

If the command output is "global", this check applies.

Check the permission of the menu.lst file.

On systems that have a ZFS root, the menu.lst file is typically located at /pool-name/boot/grub/menu.lst where "pool-name" is the mount point for the top-level dataset.

On systems that have a UFS root, the menu.lst file is typically located at /boot/grub/menu.lst .

Procedure:
# ls -lL /pool-name/boot/grub/menu.lst
or
# ls -lL /boot/grub/menu.lst

If menu.lst has a mode more permissive than 0600, this is a finding.

Check Content Reference

M

Target Key

4061

Comments