TMA-DB2-4.2.1
Restrict Access to SYSCAT.AUDITPOLICIES
Description
The SYSCAT.AUDITPOLICIES view contains all audit policies for a database. It is recommended that the PUBLIC role be restricted from accessing this view. Counts grants to PUBLIC on SYSCAT.AUDITPOLICIES (SYSCAT.TABAUTH); 0 is required. Database-level check: set DB2DBDFT to the database name to audit (the rule connects to it with the instance owner's credentials and fails when DB2DBDFT is unset). Run as the instance owner (or with sqllib/db2profile sourced) so the db2 CLP reads this instance's configuration.
How it is checked
Audit method: SQL query
db="${DB2DBDFT:?set DB2DBDFT to the database to audit}"; db2 connect to "$db" >/dev/null || exit 1; db2 -x "select count(*) from syscat.tabauth where tabschema = 'SYSCAT' and tabname = 'AUDITPOLICIES' and grantee = 'PUBLIC'"; rc=$?; db2 connect reset >/dev/null 2>&1; db2 terminate >/dev/null 2>&1; exit $rc- Expected output
0
How it is fixed
Fix method: Guidance or infrastructure patch
Perform the following to revoke access from PUBLIC. 1. Connect to the Db2 database. db2 => connect to <dbname> 2. Run the following command: db2 => REVOKE SELECT ON SYSCAT.AUDITPOLICIES FROM PUBLIC
Properties
- Operating systems
- Any
- Tags
- db2databaseprivilegescatalog
- Reference
- CIS IBM Db2 12.1 Benchmark v1.0.0 - 4.2.1 Restrict Access to SYSCAT.AUDITPOLICIES
Check this host
Run this on a machine you are allowed to audit. The scan is read-only.
tmaegis scan --target db2