TMA-AIX-2.3
Ensure Trusted Execution (TE) policies are locked
Description
Set trusted execution policy LOCK_KERN_POLICIES to enabled. All of the other policies will then be locked and cannot be changed without disabling the LOCK_KERN_POLICIES policy and then restarting the system. When policies are locked, unauthorized users cannot make changes to the policies to allow them to execute unapproved tools and then revert the settings afterwards. An unplanned system reboot is likely to be noticed and investigated Audit: automated read-only check derived from the CIS audit procedure; it prints "compliant" when the control is met.
How it is checked
Audit method: Shell command
command -v trustchk >/dev/null 2>&1 || exit 1; out=$(trustchk -p LOCK_KERN_POLICIES 2>/dev/null) || exit 1; r=compliant; for p in '^LOCK_KERN_POLICIES=ON$'; do printf '%s\n' "$out" | grep -Eq -- "$p" || r="missing: $p"; done; echo "$r"- Expected output
compliant
How it is fixed
Fix method: Guidance or infrastructure patch
Execute the following command trustchk -p LOCK_KERN_POLICIES=ON
Properties
- Operating systems
- Any
- Tags
- aixhardening
- Reference
- CIS IBM AIX 7 Benchmark v1.2.0 - 2.3 Ensure Trusted Execution (TE) policies are locked
Check this host
Run this on a machine you are allowed to audit. The scan is read-only.
tmaegis scan --target aix --level 2