Detections
Analytics

1.232 OL09-00-002072

Information

OL 9 must prevent code from being executed on file systems that contain user home directories.

GROUP ID: V-271668
RULE ID: SV-271668r1091716

The noexec mount option causes the system to not execute binary files. This option must be used for mounting any file system not containing approved binary files, as they may be incompatible. Executing files from untrusted file systems increases the opportunity for nonprivileged users to attain unauthorized administrative access.

Solution

Configure OL 9 to prevent code from being executed on file systems that contain user home directories.

Modify "/etc/fstab" to use the "noexec" option on the "/home" directory.

See Also

https://workbench.cisecurity.org/benchmarks/27024

Item Details

Category: CONFIGURATION MANAGEMENT

References: 800-53|CM-6b., CCI|CCI-000366, Rule-ID|SV-271668r1091716_rule, STIG-ID|OL09-00-002072, Vuln-ID|V-271668

Plugin: Unix

Control ID: cea0ee9febe027d3afe8d52178711b64df23614a07cbc89bb3d512f1fc5c485f