Detections
Analytics
OL09-00-002066 - OL 9 must mount /var/log/audit with the nosuid option.
Information
The "nosuid" mount option causes the system to not execute "setuid" and "setgid" files with owner privileges. This option must be used for mounting any file system not containing approved "setuid" and "setguid" files. Executing files from untrusted file systems increases the opportunity for nonprivileged users to attain unauthorized administrative access.Solution
Configure OL 9 to mount /var/log/audit with the nosuid option.Modify "/etc/fstab" to use the "nosuid" option on the "/var/log/audit" directory.
See Also
https://dl.dod.cyber.mil/wp-content/uploads/stigs/zip/U_Oracle_Linux_9_V1R4_STIG.zip
Item Details
Audit Name: DISA Oracle Linux 9 STIG v1r4
Category: CONFIGURATION MANAGEMENT
References: 800-53|CM-7(2), CAT|II, CCI|CCI-001764, Rule-ID|SV-271662r1091698_rule, STIG-ID|OL09-00-002066, Vuln-ID|V-271662
Plugin: Unix
Control ID: ed3e3009c647606527339dd67e064112029a4874d3519c829aa0cd4facd302eb