Restrict Access to SYSCAT.CONTROLDEP

СредњаНиво 1Аутоматскаdb2

Опис

The SYSCAT.CONTROLDEP view contains the dependency of a row permission or column mask on some other object. It is recommended that the PUBLIC role be restricted from accessing this view. Counts grants to PUBLIC on SYSCAT.CONTROLDEP (SYSCAT.TABAUTH); 0 is required. Database-level check: set DB2DBDFT to the database name to audit (the rule connects to it with the instance owner's credentials and fails when DB2DBDFT is unset). Run as the instance owner (or with sqllib/db2profile sourced) so the db2 CLP reads this instance's configuration.

Како се проверава

Метод провере: SQL упит

sql_query

db="${DB2DBDFT:?set DB2DBDFT to the database to audit}"; db2 connect to "$db" >/dev/null || exit 1; db2 -x "select count(*) from syscat.tabauth where tabschema = 'SYSCAT' and tabname = 'CONTROLDEP' and grantee = 'PUBLIC'"; rc=$?; db2 connect reset >/dev/null 2>&1; db2 terminate >/dev/null 2>&1; exit $rc

Очекивани излаз: 0

Како се исправља

Метод исправке: Смерница или закрпа инфраструктуре

Perform the following to revoke access from PUBLIC. 1. Connect to the Db2 database. db2 => connect to <dbname> 2. Run the following command: db2 => REVOKE SELECT ON SYSCAT.CONTROLDEP FROM PUBLIC

Својства

Оперативни системи: Било који
Ознаке: db2databaseprivilegescatalog
Референца: CIS IBM Db2 12.1 Benchmark v1.0.0 - 4.2.9 Restrict Access to SYSCAT.CONTROLDEP

Проверите овај рачунар

Покрените ово на рачунару за који имате дозволу за проверу. Скенирање ради у режиму само за читање.

shell

tmaegis scan --target db2