Ensure only / permits device files.

보통레벨 1자동aix

설명

The filesystem mount option nodev ensures that special device files are not recognized as device files. This recommendation audits all rootvg filesystems to ensure that only the root filesystem '/' allows the use of device special files. Audit: automated read-only check derived from the CIS audit procedure; it prints "compliant" when the control is met.

점검 방법

감사 방식: 셸 명령

shell

command -v lsfs >/dev/null 2>&1 || exit 1; out=$( { lsfs | grep jfs | egrep -v "/dev/hd4|nodev"; mount | grep jfs | egrep -v "/dev/hd4|nodev" ; } 2>/dev/null ); [ -z "$out" ] && echo compliant || printf '%s\n' "$out" | head -n 20

예상 출력: compliant

조치 방법

조치 방식: 가이드 또는 인프라 패치

The following command remounts filesystems with 'nodev' added: mount | grep jfs | /usr/bin/egrep -v "/dev/hd4|nodev" | while read lv fs jfs m d t options do mount -o remount,${options},nodev $fs done The following command updates the stanza in /etc/filesystems lsfs | grep jfs | /usr/bin/egrep -v "/dev/hd4|nodev" | while read lv node fs jfs size options rest do if [ ${options} == "--" ]; then chfs -a options=nodev $fs else chfs -a options=${options},nodev $fs fi done

속성

운영 체제: 모두
태그: aixpermissions
참고 자료: CIS IBM AIX 7 Benchmark v1.2.0 - 4.4.3.1 Ensure only / permits device files.

이 호스트 점검하기

감사 권한이 있는 시스템에서 실행하세요. 스캔은 읽기 전용입니다.

shell

tmaegis scan --target aix