Detections
Analytics

SOL-11.1-070260 - The operator must document all file system objects that have non-standard access control list settings.

Information

Access Control Lists allow an object owner to expand permissions on an object to specific users and groups in addition to the standard permission model. Non-standard Access Control List settings can allow unauthorized users to modify critical files.

Solution

The root role is required.

Remove ACLs that are not approved in the security policy.

For ZFS file systems, remove all extended ACLs with the following command:

# chmod A- [filename]

For UFS file systems

Determine the ACLs that are set on a file:

# getfacl [filename]

Remove any ACL configurations that are set:

# setfacl -d [ACL] [filename]

See Also

https://dl.dod.cyber.mil/wp-content/uploads/stigs/zip/U_SOL_11_x86_V3R6_STIG.zip

Item Details

Category: CONFIGURATION MANAGEMENT

References: 800-53|CM-6b., CAT|II, CCI|CCI-000366, Rule-ID|SV-216204r959010_rule, STIG-ID|SOL-11.1-070260, STIG-Legacy|SV-60901, STIG-Legacy|V-48029, Vuln-ID|V-216204

Plugin: Unix

Control ID: 822c581a2243826ce5bf3dc0d78986bd96d83b0799c2bbd675ebf9d0ca5b6481