Ensure Trusted Execution (TE) policies are locked

高级别 2自动化aix

说明

Set trusted execution policy LOCK_KERN_POLICIES to enabled. All of the other policies will then be locked and cannot be changed without disabling the LOCK_KERN_POLICIES policy and then restarting the system. When policies are locked, unauthorized users cannot make changes to the policies to allow them to execute unapproved tools and then revert the settings afterwards. An unplanned system reboot is likely to be noticed and investigated Audit: automated read-only check derived from the CIS audit procedure; it prints "compliant" when the control is met.

检查方式

审计方法: Shell 命令

shell

command -v trustchk >/dev/null 2>&1 || exit 1; out=$(trustchk -p LOCK_KERN_POLICIES 2>/dev/null) || exit 1; r=compliant; for p in '^LOCK_KERN_POLICIES=ON$'; do printf '%s\n' "$out" | grep -Eq -- "$p" || r="missing: $p"; done; echo "$r"

预期输出: compliant

修复方式

修复方法: 操作指南或基础设施补丁

Execute the following command trustchk -p LOCK_KERN_POLICIES=ON

属性

操作系统: 任意
标签: aixhardening
参考: CIS IBM AIX 7 Benchmark v1.2.0 - 2.3 Ensure Trusted Execution (TE) policies are locked

检查本机

请在您有权审计的机器上运行此命令。扫描为只读操作。

shell

tmaegis scan --target aix --level 2