Ensure SUID and SGID files are reviewed

점검 방법

감사 방식: 수동 검토

이 권장 사항은 자동으로 점검할 수 없습니다. --include-manual 옵션을 전달하면 스캔 결과에 이 지침과 함께 표시됩니다.

Re-execute the appropriate find command and review the output. This should reflect the changes made in the remediation section. If there are non-local filesystems which cannot be un-mounted, use the following to find all suid and sgid files on local JFS/JFS2 filesystems only: find / \( -fstype jfs -o -fstype jfs2 \) \( -perm -04000 -o -perm -02000 \) - type f -ls If all non-local filesystems are un-mounted: find / \( -perm -04000 -o -perm -02000 \) -type f -ls

조치 방법

조치 방식: 가이드 또는 인프라 패치

Review the currently mounted filesystems: mount Un-mount all non-local filesystems and cdrom media: unmount <mount point> If there are non-local filesystems which cannot be un-mounted, use the following to find all suid and sgid files on local JFS/JFS2 filesystems only: find / \( -fstype jfs -o -fstype jfs2 \) \( -perm -04000 -o -perm -02000 \) - type f -ls If all non-local filesystems have been un-mounted: find / \( -perm -04000 -o -perm -02000 \) -type f -ls Review the files and where possible, use the chmod command to remove the appropriate suid or sgid bits: chmod u-s <file> chmod g-s <file>