TMA-DB2-4.2.9

Restrict Access to SYSCAT.CONTROLDEP

中レベル 1自動db2

説明

The SYSCAT.CONTROLDEP view contains the dependency of a row permission or column mask on some other object. It is recommended that the PUBLIC role be restricted from accessing this view. Counts grants to PUBLIC on SYSCAT.CONTROLDEP (SYSCAT.TABAUTH); 0 is required. Database-level check: set DB2DBDFT to the database name to audit (the rule connects to it with the instance owner's credentials and fails when DB2DBDFT is unset). Run as the instance owner (or with sqllib/db2profile sourced) so the db2 CLP reads this instance's configuration.

チェック方法

監査方法: SQL クエリ

sql_query

db="${DB2DBDFT:?set DB2DBDFT to the database to audit}"; db2 connect to "$db" >/dev/null || exit 1; db2 -x "select count(*) from syscat.tabauth where tabschema = 'SYSCAT' and tabname = 'CONTROLDEP' and grantee = 'PUBLIC'"; rc=$?; db2 connect reset >/dev/null 2>&1; db2 terminate >/dev/null 2>&1; exit $rc

期待される出力: 0

修正方法

修正方法: ガイダンスまたは IaC パッチ

Perform the following to revoke access from PUBLIC. 1. Connect to the Db2 database. db2 => connect to <dbname> 2. Run the following command: db2 => REVOKE SELECT ON SYSCAT.CONTROLDEP FROM PUBLIC

プロパティ

オペレーティングシステム: すべて
タグ: db2databaseprivilegescatalog
参照: CIS IBM Db2 12.1 Benchmark v1.0.0 - 4.2.9 Restrict Access to SYSCAT.CONTROLDEP

このホストをチェック

監査が許可されているマシンで実行してください。スキャンは読み取り専用です。

shell

tmaegis scan --target db2