GEN002440 - The owner, group-owner, mode, ACL, and location of files with the setgid bit set must be documented using site-defined procedures.

Information

All files with the setgid bit set will allow anyone running these files to be temporarily assigned the GID of the file. While many system files depend on these attributes for proper operation, security problems can result if setgid is assigned to programs that allow reading and writing of files, or shell escapes.

Solution

All files with the setgid bit set will be documented in the system baseline and authorized by the Information Systems Security Officer. Locate all setgid files with the following command.

find / -perm -2000 -exec ls -lLd {} ;

Ensure setgid files are part of the operating system software, documented application software, documented utility software, or documented locally developed software. Ensure none are text files or shell programs.

Item Details

Audit Name: DISA STIG Solaris 10 X86 v2r4

Category: CONFIGURATION MANAGEMENT

Plugin: Unix

Control ID: 07442d50ba1a2add64953c910ac8eb640b1b0388318317129ef7e6c6b88f2fe6

Detections

Analytics

GEN002440 - The owner, group-owner, mode, ACL, and location of files with the setgid bit set must be documented using site-defined procedures.

Information

Solution

See Also

Item Details