AIX7-00-001138 - NFS file systems on AIX must be mounted with the nosuid option unless the NFS file systems contain approved setuid or setgid programs.

Information

The nosuid mount option causes the system to not execute setuid files with owner privileges. This option must be used for mounting any file system not containing approved setuid files. Executing setuid files from untrusted file systems, or file systems not containing approved setuid files, increases the opportunity for unprivileged users to attain unauthorized administrative access.

Solution

For each NFS file systems that does not contain approved "setuid" or "setgid" files, add the "nosuid" option, along with other mount options, to the "options" field in "/etc/filesystems" using the following command:
# chfs -a options=ro,bg,hard,intr,nosuid,sec=sys <NFS_mount_point>

Note that the other mount options (other than the nosuid options) may be different among NFS mounts.

Item Details

Audit Name: DISA IBM AIX 7.x STIG v3r2

Category: ACCESS CONTROL

Plugin: Unix

Control ID: 4718fb9e41656b5f0b0c937869a1b815af329db60b4e7748c54b4a36143a1ab3

Detections

Analytics

AIX7-00-001138 - NFS file systems on AIX must be mounted with the nosuid option unless the NFS file systems contain approved setuid or setgid programs.

Information

Solution

See Also

Item Details