Detections
Analytics

1.233 OL09-00-002080

Information

OL 9 must prevent special devices on nonroot local partitions.

GROUP ID: V-271669
RULE ID: SV-271669r1184200

The "nodev" mount option causes the system to not interpret character or block special devices. Executing character or block special devices from untrusted file systems increases the opportunity for nonprivileged users to attain unauthorized administrative access.

The only legitimate location for device files is the "/dev" directory located on the root partition, with the exception of chroot jails if implemented.

Solution

Configure the "/etc/fstab" to use the "nodev" option on all nonroot local partitions.

See Also

https://workbench.cisecurity.org/benchmarks/27024

Item Details

Category: CONFIGURATION MANAGEMENT

References: 800-53|CM-6b., CCI|CCI-000366, Rule-ID|SV-271669r1184200_rule, STIG-ID|OL09-00-002080, Vuln-ID|V-271669

Plugin: Unix

Control ID: 72257eede18dfa4487d0e2d917eae611cf228d37d4231155b526491141b32a9c