Detections
Analytics

4.4.3.1 Ensure only / permits device files.

Information

The filesystem mount option nodev ensures that special device files are not recognized as device files. This recommendation audits all rootvg filesystems to ensure that only the root filesystem '/' allows the use of device special files.

NOTE: Nessus has provided the target output to assist in reviewing the benchmark to ensure target compliance.

Solution

- The following command remounts filesystems with 'nodev' added:

mount | grep jfs | /usr/bin/egrep -v "/dev/hd4|nodev" | while read lv fs jfs m d t options
do
mount -o remount,${options},nodev $fs
done

 - The following command updates the stanza in /etc/filesystems

lsfs | grep jfs | /usr/bin/egrep -v "/dev/hd4|nodev" | while read lv node fs jfs size options rest
do
if [ ${options} == "--" ]; then
 chfs -a options=nodev $fs
else
 chfs -a options=${options},nodev $fs
fi
done

Impact:

If the system is acting as a WPAR host then restricting where device files may exist may impact on the ability to start WPARs. You should ensure that any filesystems which are used to host the root filesystem for a WPAR are excluded from remediation.

Note: WPARS built as filesystems should be considered non-production or test. Production WPARs should be located solely in WPAR storage devices. See the option mkwpar -D.

See Also

https://workbench.cisecurity.org/benchmarks/22751

Item Details

Category: ACCESS CONTROL, MEDIA PROTECTION

References: 800-53|AC-3, 800-53|AC-5, 800-53|AC-6, 800-53|MP-2, CSCv7|14.6

Plugin: Unix

Control ID: 261f2bedcac591f058058a6ff1c4703d773c2a2d98d6faee0867b263f1321808