Ensure there are no system 'default group' writable files (objects)

Како се проверава

Метод провере: Команда љуске

command -v lsgroup >/dev/null 2>&1 || exit 1; out=$( { for grp in $(lsgroup -a admin ALL | awk '$2=="admin=true"{print $1}'); do find / \( -fstype jfs -o -fstype jfs2 \) ! -type d -perm -g+w -group "$grp" -print; done ; } 2>/dev/null ); [ -z "$out" ] && echo compliant || printf '%s\n' "$out" | head -n 20

Очекивани излаз

compliant

Како се исправља

Метод исправке: Смерница или закрпа инфраструктуре

Review the currently mounted local filesystems using the following to find all world writable files on local JFS/JFS2 filesystems only: Note: the list generated by the command below is for all groups, not just the default system groups. the command without the argument -ls will create a list than can be fed to /usr/bin/xargs to blindly remove the group write permissions. find -L / \( -fstype jfs -o -fstype jfs2 \) -type f -perm -g+w -ls Remedy any files in the list, e.g., chmod g-w {filename} Document any files, and motivate why they are group writeable, and also add documentation re: when/why this exception ceases.

Проверите овај рачунар

Покрените ово на рачунару за који имате дозволу за проверу. Скенирање ради у режиму само за читање.

tmaegis scan --target aix --level 2