TMAegis
更多 linux 规则

TMA-ROCKY8-7.1.12

Ensure no files or directories without an owner and a group exist

中级别 1自动化linux

说明

Administrators may delete users or groups from the system and neglect to remove all files and/or directories owned by those users or groups.

检查方式

审计方法: Shell 命令

shell
alt0() { o=$(bash -c '#!/usr/bin/env bash

{
   a_output=() a_output2=() a_nouser=() a_nogroup=() # Initialize arrays
   a_path=(-path "*/containers/storage/*" -o -path "*/containerd/*" -o -path "*/kubelet/*" -o -path "/sys/*" -o -path "/snap/*" -o -path "/boot/efi/*")
   while IFS= read -r l_mount; do
      while IFS= read -r -d $'"'"'\0'"'"' l_file; do
         if [ -e "$l_file" ]; then
            while IFS=: read -r l_user l_group; do
               [ "$l_user" = "UNKNOWN" ] && a_nouser+=("$l_file")
               [ "$l_group" = "UNKNOWN" ] && a_nogroup+=("$l_file")
            done < <(stat -Lc '"'"'%U:%G'"'"' "$l_file")
         fi
      done < <(find "$l_mount" -mount -xdev \( "${a_path[@]}" \) -prune -o \( -type f -o -type d \) \( -nouser -o -nogroup \) -print0 2> /dev/null)
   done < <(findmnt -Dkerno fstype,target | awk '"'"'($1 !~ /^\s*(nfs|proc|cifs|smb|vfat|iso9660|efivarfs|selinuxfs|ncpfs)/ && $2 !~ /^(\/run|\/tmp|\/var\/tmp)(\/|$)/){print $2}'"'"')
   if ! (( ${#a_nouser[@]} > 0 )); then
      a_output+=("  - No files or directories without an owner exist on the local filesystem.")
   else
      a_output2+=("  - There are \"$(printf '"'"'%s'"'"' "${#a_nouser[@]}")\" unowned files or directories on the system." \
      "   - The following is a list of unowned files and/or directories:\n$(printf '"'"'%s\n'"'"' "${a_nouser[@]}")" "   - end of list")
   fi
   if ! (( ${#a_nogroup[@]} > 0 )); then
      a_output+=("  - No files or directories without a group owner exist on the local filesystem.")
   else
      a_output2+=("  - There are \"$(printf '"'"'%s'"'"' "${#a_nogroup[@]}")\" ungrouped files or directories on the system." \
      "   - The following is a list of ungrouped files and/or directories:\n$(printf '"'"'%s\n'"'"' "${a_nogroup[@]}")" "   - end of list")
   fi
   if [ "${#a_output2[@]}" -le 0 ]; then
      printf '"'"'%s\n'"'"' "" "- Audit Result:" "  ** PASS **" "${a_output[@]}"
   else
      printf '"'"'%s\n'"'"' "" "- Audit Result:" "  ** FAIL **" "  * Reasons for audit failure *" "${a_output2[@]}" ""
      [ "${#a_output[@]}" -gt 0 ] && printf '"'"'%s\n'"'"' "- Correctly set:" "${a_output[@]}"
   fi
}' 2>&1); printf '%s\n' "$o" | grep -q '\*\* PASS \*\*' || { echo "step1: script did not report PASS"; return 1; }; }; if alt0; then echo compliant; fi
预期输出
compliant

修复方式

修复方法: 操作指南或基础设施补丁

Remove or set ownership and group ownership of these files and/or directories to an active user on the system as appropriate.

属性

操作系统
rocky-8
标签
cis-convertedlinux
参考
CIS Rocky Linux 8 Benchmark v3.0.0 - 7.1.12

检查本机

请在您有权审计的机器上运行此命令。扫描为只读操作。

shell
tmaegis scan --target linux