Find Files and Directories with Extended Attributes

SrednjaNivo 1Automatskasolaris

Opis

Extended attributes are implemented as files in a "shadow" file system that is not generally visible via normal administration commands without special arguments. Attackers or malicious users could "hide" information, exploits, etc. in extended attribute areas. Since extended attributes are rarely used, it is important to find files with extended attributes set. Audit: automated read-only check derived from the CIS audit procedure; it prints "compliant" when the control is met.

Kako se proverava

Metod provere: Komanda ljuske

shell

command -v find >/dev/null 2>&1 || exit 1; out=$( { find / \( -fstype nfs -o -fstype cachefs -o -fstype autofs -o -fstype ctfs -o -fstype mntfs -o -fstype objfs -o -fstype proc \) -prune -o -xattr -ls ; } 2>/dev/null ); [ -z "$out" ] && echo compliant || printf '%s\n' "$out" | head -n 20

Očekivani izlaz: compliant

Kako se ispravlja

Metod ispravke: Smernica ili zakrpa infrastrukture

Correct or justify any items discovered in the Audit step. Determine the existence of any files having extended file attributes, and determine the best course of action in accordance with site policy. Note that the Solaris OS does not ship with files that have extended attributes.

Svojstva

Operativni sistemi: Bilo koji
Oznake: solarispermissions
Referenca: CIS Oracle Solaris 11.4 Benchmark v1.1.0 - 9.24 Find Files and Directories with Extended Attributes

Proverite ovaj računar

Pokrenite ovo na računaru za koji imate dozvolu za proveru. Skeniranje radi u režimu samo za čitanje.

shell

tmaegis scan --target solaris