Ensure SUID and SGID files are reviewed

Како се проверава

Метод провере: Ручни преглед

Ова препорука се не може проверити аутоматски. Скенирање је наводи са овим упутствима када проследите --include-manual.

Re-execute the appropriate find command and review the output. This should reflect the changes made in the remediation section. If there are non-local filesystems which cannot be un-mounted, use the following to find all suid and sgid files on local JFS/JFS2 filesystems only: find / \( -fstype jfs -o -fstype jfs2 \) \( -perm -04000 -o -perm -02000 \) - type f -ls If all non-local filesystems are un-mounted: find / \( -perm -04000 -o -perm -02000 \) -type f -ls

Како се исправља

Метод исправке: Смерница или закрпа инфраструктуре

Review the currently mounted filesystems: mount Un-mount all non-local filesystems and cdrom media: unmount <mount point> If there are non-local filesystems which cannot be un-mounted, use the following to find all suid and sgid files on local JFS/JFS2 filesystems only: find / \( -fstype jfs -o -fstype jfs2 \) \( -perm -04000 -o -perm -02000 \) - type f -ls If all non-local filesystems have been un-mounted: find / \( -perm -04000 -o -perm -02000 \) -type f -ls Review the files and where possible, use the chmod command to remove the appropriate suid or sgid bits: chmod u-s <file> chmod g-s <file>