Ensure only / permits device files.

MediaNivel 1Automatizadaaix

Descripción

The filesystem mount option nodev ensures that special device files are not recognized as device files. This recommendation audits all rootvg filesystems to ensure that only the root filesystem '/' allows the use of device special files. Audit: automated read-only check derived from the CIS audit procedure; it prints "compliant" when the control is met.

Cómo se verifica

Método de auditoría: Comando de shell

shell

command -v lsfs >/dev/null 2>&1 || exit 1; out=$( { lsfs | grep jfs | egrep -v "/dev/hd4|nodev"; mount | grep jfs | egrep -v "/dev/hd4|nodev" ; } 2>/dev/null ); [ -z "$out" ] && echo compliant || printf '%s\n' "$out" | head -n 20

Salida esperada: compliant

Cómo se corrige

Método de corrección: Guía o parche de infraestructura

The following command remounts filesystems with 'nodev' added: mount | grep jfs | /usr/bin/egrep -v "/dev/hd4|nodev" | while read lv fs jfs m d t options do mount -o remount,${options},nodev $fs done The following command updates the stanza in /etc/filesystems lsfs | grep jfs | /usr/bin/egrep -v "/dev/hd4|nodev" | while read lv node fs jfs size options rest do if [ ${options} == "--" ]; then chfs -a options=nodev $fs else chfs -a options=${options},nodev $fs fi done

Propiedades

Sistemas operativos: Cualquiera
Etiquetas: aixpermissions
Referencia: CIS IBM AIX 7 Benchmark v1.2.0 - 4.4.3.1 Ensure only / permits device files.

Verificar este host

Ejecute esto en un equipo que tenga permiso para auditar. El escaneo es de solo lectura.

shell

tmaegis scan --target aix