Restrict Access to SYSCAT.CONTEXTATTRIBUTES

中等級 1自動化db2

說明

The SYSCAT.CONTEXTATTRIBUTES view contains all the trusted context attributes in the database instance. It is recommended that the PUBLIC role be restricted from accessing this view. Counts grants to PUBLIC on SYSCAT.CONTEXTATTRIBUTES (SYSCAT.TABAUTH); 0 is required. Database-level check: set DB2DBDFT to the database name to audit (the rule connects to it with the instance owner's credentials and fails when DB2DBDFT is unset). Run as the instance owner (or with sqllib/db2profile sourced) so the db2 CLP reads this instance's configuration.

檢查方式

稽核方法: SQL 查詢

sql_query

db="${DB2DBDFT:?set DB2DBDFT to the database to audit}"; db2 connect to "$db" >/dev/null || exit 1; db2 -x "select count(*) from syscat.tabauth where tabschema = 'SYSCAT' and tabname = 'CONTEXTATTRIBUTES' and grantee = 'PUBLIC'"; rc=$?; db2 connect reset >/dev/null 2>&1; db2 terminate >/dev/null 2>&1; exit $rc

預期輸出: 0

修補方式

修補方法: 操作指南或基礎設施修補檔

Perform the following to revoke access from PUBLIC. 1. Connect to the Db2 database. db2 => connect to <dbname> 2. Run the following command: db2 => REVOKE SELECT ON SYSCAT.CONTEXTATTRIBUTES FROM PUBLIC

屬性

作業系統: 不限
標籤: db2databaseprivilegescatalog
參考資料: CIS IBM Db2 12.1 Benchmark v1.0.0 - 4.2.7 Restrict Access to SYSCAT.CONTEXTATTRIBUTES

檢查此主機

請在您有權稽核的機器上執行此指令。掃描為唯讀操作。

shell

tmaegis scan --target db2