Ensure there are no system 'default group' writable files (objects)

Nasıl denetlenir

Denetim yöntemi: Kabuk komutu

command -v lsgroup >/dev/null 2>&1 || exit 1; out=$( { for grp in $(lsgroup -a admin ALL | awk '$2=="admin=true"{print $1}'); do find / \( -fstype jfs -o -fstype jfs2 \) ! -type d -perm -g+w -group "$grp" -print; done ; } 2>/dev/null ); [ -z "$out" ] && echo compliant || printf '%s\n' "$out" | head -n 20

Beklenen çıktı

compliant

Nasıl düzeltilir

Düzeltme yöntemi: Kılavuz veya altyapı yaması

Review the currently mounted local filesystems using the following to find all world writable files on local JFS/JFS2 filesystems only: Note: the list generated by the command below is for all groups, not just the default system groups. the command without the argument -ls will create a list than can be fed to /usr/bin/xargs to blindly remove the group write permissions. find -L / \( -fstype jfs -o -fstype jfs2 \) -type f -perm -g+w -ls Remedy any files in the list, e.g., chmod g-w {filename} Document any files, and motivate why they are group writeable, and also add documentation re: when/why this exception ceases.

Bu ana makineyi denetle

Bunu denetleme izniniz olan bir makinede çalıştırın. Tarama salt okunurdur.

tmaegis scan --target aix --level 2