Detections
Analytics

1.213 SOL-11.1-100030

Information

The systems physical devices must not be assigned to non-global zones.

GROUP ID: V-216240RULE ID: SV-216240r959010

Solaris non-global zones can be assigned physical hardware devices. This increases the risk of such a non-global zone having the capability to compromise the global zone.

Solution

This check applies to the global zone only. Determine the zone that you are currently securing.

zonename

If the command output is "global", this check applies.

The Zone Security profile is required:

Remove all device assignments from the non-global zone.

pfexec zonecfg -z [zone] delete device [device]

See Also

https://workbench.cisecurity.org/benchmarks/23873

Item Details

Category: CONFIGURATION MANAGEMENT

References: 800-53|CM-6b., CAT|II, CCI|CCI-000366, Rule-ID|SV-216240r959010_rule, STIG-ID|SOL-11.1-100030, Vuln-ID|V-216240

Plugin: Unix

Control ID: 894ed304c6601568f00a5bf709b5e07078d3229f8b76643a3ec880508e824d28