Detections
Analytics

SOL-11.1-100030 - The systems physical devices must not be assigned to non-global zones.

Information

Solaris non-global zones can be assigned physical hardware devices. This increases the risk of such a non-global zone having the capability to compromise the global zone.

Solution

This check applies to the global zone only. Determine the zone that you are currently securing.

# zonename

If the command output is "global", this check applies.

The Zone Security profile is required:

Remove all device assignments from the non-global zone.

# pfexec zonecfg -z [zone] delete device [device]

See Also

https://dl.dod.cyber.mil/wp-content/uploads/stigs/zip/U_SOL_11_x86_V3R6_STIG.zip

Item Details

Category: CONFIGURATION MANAGEMENT

References: 800-53|CM-6b., CAT|II, CCI|CCI-000366, Rule-ID|SV-216240r959010_rule, STIG-ID|SOL-11.1-100030, STIG-Legacy|SV-60715, STIG-Legacy|V-47841, Vuln-ID|V-216240

Plugin: Unix

Control ID: c7b37773cd6a46e8e945c51416ca64925a70b738203b85b6a5ff0219bacd53e9