GEN002440 - The owner, group-owner, mode, ACL, and location of files with the setgid bit set must be documented using site-defined procedures.

Information

All files with the setgid bit set will allow anyone running these files to be temporarily assigned the GID of the file. While many system files depend on these attributes for proper operation, security problems can result if setgid is assigned to programs that allow reading and writing of files, or shell escapes.

Solution

All files with the setgid bit set will be documented in the system baseline and authorized by the Information Systems Security Officer. Locate all setgid files with the following command.

find / -perm -2000 -exec ls -lLd {} ;

Ensure setgid files are part of the operating system software, documented application software, documented utility software, or documented locally developed software. Ensure none are text files or shell programs.

Item Details

Audit Name: DISA STIG Solaris 10 SPARC v2r4

Category: CONFIGURATION MANAGEMENT

Plugin: Unix

Control ID: 9bdaeaa34eb15772512d3d378a306c285550c737137f764ba4a61317e82f201b

Detections

Analytics

GEN002440 - The owner, group-owner, mode, ACL, and location of files with the setgid bit set must be documented using site-defined procedures.

Information

Solution

See Also

Item Details