Detections
Analytics

1.6.1.9 Ensure non-privileged users are prevented from executing privileged functions

Warning! Audit Deprecated

This audit has been deprecated and will be removed in a future update.

View Next Audit Version

Information

The operating system must prevent non-privileged users from executing privileged functions to include disabling, circumventing, or altering implemented security safeguards/countermeasures.

Preventing non-privileged users from executing privileged functions mitigates the risk that unauthorized individuals or processes may gain unnecessary access to information or privileges.

Privileged functions include, for example, establishing accounts, performing system integrity checks, or administering cryptographic key management activities. Non-privileged users are individuals who do not possess appropriate authorizations. Circumventing intrusion detection and prevention mechanisms or malicious code protection mechanisms are examples of privileged functions that require protection from non-privileged users.

NOTE: Nessus has provided the target output to assist in reviewing the benchmark to ensure target compliance.

Solution

Configure the operating system to prevent non-privileged users from executing privileged functions to include disabling, circumventing, or altering implemented security safeguards/countermeasures.

Utilizing the list of users gathered in the Audit section run the applicable command for that user below.

Use the following command to map a new user to the sysdam_u role:

# semanage login -a -s sysadm_u <username>

Use the following command to map an existing user to the sysdam_u role:

# semanage login -m -s sysadm_u <username>

Use the following command to map a new user to the staff_u role:

# semanage login -a -s staff_u <username>

Use the following command to map an existing user to the staff_u role:

# semanage login -m -s staff_u <username>

Use the following command to map a new user to the user_u role:

# semanage login -a -s user_u <username>

Use the following command to map an existing user to the user_u role:

# semanage login -m -s user_u <username>

See Also

https://workbench.cisecurity.org/benchmarks/8415

Item Details

Category: ACCESS CONTROL

References: 800-53|AC-3(4), 800-53|AC-6(10), CAT|II, CCI|CCI-002165, CCI|CCI-002235, CSCv7|4, Rule-ID|SV-204444r754744_rule, STIG-ID|RHEL-07-020020, Vuln-ID|V-204444

Plugin: Unix

Control ID: d34a631042a3299749363421411355cdd68323e445ec315419256763bdca3c38