Ensure only / permits device files.

SrednjaNivo 1Automatskaaix

Opis

The filesystem mount option nodev ensures that special device files are not recognized as device files. This recommendation audits all rootvg filesystems to ensure that only the root filesystem '/' allows the use of device special files. Audit: automated read-only check derived from the CIS audit procedure; it prints "compliant" when the control is met.

Kako se proverava

Metod provere: Komanda ljuske

shell

command -v lsfs >/dev/null 2>&1 || exit 1; out=$( { lsfs | grep jfs | egrep -v "/dev/hd4|nodev"; mount | grep jfs | egrep -v "/dev/hd4|nodev" ; } 2>/dev/null ); [ -z "$out" ] && echo compliant || printf '%s\n' "$out" | head -n 20

Očekivani izlaz: compliant

Kako se ispravlja

Metod ispravke: Smernica ili zakrpa infrastrukture

The following command remounts filesystems with 'nodev' added: mount | grep jfs | /usr/bin/egrep -v "/dev/hd4|nodev" | while read lv fs jfs m d t options do mount -o remount,${options},nodev $fs done The following command updates the stanza in /etc/filesystems lsfs | grep jfs | /usr/bin/egrep -v "/dev/hd4|nodev" | while read lv node fs jfs size options rest do if [ ${options} == "--" ]; then chfs -a options=nodev $fs else chfs -a options=${options},nodev $fs fi done

Svojstva

Operativni sistemi: Bilo koji
Oznake: aixpermissions
Referenca: CIS IBM AIX 7 Benchmark v1.2.0 - 4.4.3.1 Ensure only / permits device files.

Proverite ovaj računar

Pokrenite ovo na računaru za koji imate dozvolu za proveru. Skeniranje radi u režimu samo za čitanje.

shell

tmaegis scan --target aix