Secure the Python Runtime Path (PYTHON_PATH)

보통레벨 1자동db2

설명

The PYTHON_PATH parameter contains the directory under which the Python runtime is installed. It is recommended that the owner of this directory is bin on Linux and AIX, and a member of the Db2 administration group on Windows. The directory should have read and execute permission for all users, but only write permission for the owner. Automated as: the PYTHON_PATH directory is not group- or world-writable (an unset PYTHON_PATH passes); the benchmark also expects owner bin on Linux/AIX, which is checked manually. Run as the instance owner (or with sqllib/db2profile sourced) so the db2 CLP reads this instance's configuration.

점검 방법

감사 방식: 셸 명령

shell

out=$(db2 get dbm cfg 2>/dev/null) || exit 1; p=$(printf '%s\n' "$out" | sed -n 's/.*(PYTHON_PATH) *= *//p' | sed 's/[[:space:]]*$//'); [ -n "$p" ] || { echo compliant; exit 0; }; [ -e "$p" ] || { echo "noncompliant: $p does not exist"; exit 0; }; w=$(find "$p" -prune \( -perm -020 -o -perm -002 \) -print); [ -z "$w" ] && echo compliant || echo "noncompliant: $p is group/world writable"

예상 출력: compliant

조치 방법

조치 방식: 가이드 또는 인프라 패치

For Windows and Linux: 1. Attach to the Db2 instance. db2 => attach to <db2instance> 2. Run the following command to change the Python path, if necessary: db2 => update database manager configuration using python_path <valid directory> Additional steps for Windows: 1. Connect to the Db2 host 2. Right-click over the directory used as the Python path 3. Choose Properties 4. Select the Security tab 5. Assign ownership of the directory to the Db2 Administrator 6. Grant all Db2 administrator accounts the Full Control authority 7. Grant only read and execute privileges to all other users (revoke all other privileges) Additional steps for Linux: 1. Connect to the Db2 host as root 2. Change to the directory used as the Python path 3. Assign bin to be the owner of the directory using the chown command 4. Change the permissions for the directory $ chmod -R 755

속성

운영 체제: 모두
태그: db2databasefilesystem
참고 자료: CIS IBM Db2 12.1 Benchmark v1.0.0 - 3.1.9 Secure the Python Runtime Path (PYTHON_PATH)

이 호스트 점검하기

감사 권한이 있는 시스템에서 실행하세요. 스캔은 읽기 전용입니다.

shell

tmaegis scan --target db2