Check: AZLX-23-002590
Amazon Linux 2023 STIG:
AZLX-23-002590
(in version v1 r1)
Title
Amazon Linux 2023 must mount /dev/shm with the nosuid option. (Cat II impact)
Discussion
The "nosuid" mount option causes the system to not execute "setuid" and "setgid" files with owner privileges. This option must be used for mounting any file system not containing approved "setuid" and "setguid" files. Executing files from untrusted file systems increases the opportunity for nonprivileged users to attain unauthorized administrative access.
Check Content
Verify Amazon Linux 2023 is configured so that "/dev/shm" is mounted with the "nosuid" option with the following command: $ mount | grep /dev/shm tmpfs on /dev/shm type tmpfs (rw,nodev,nosuid,noexec,seclabel) If the /dev/shm file system is mounted without the "noexec" option, this is a finding.
Fix Text
Configure Amazon Linux 2023 so that "/dev/shm" is mounted with the "nosuid" option. Modify "/etc/fstab" to use the "nosuid" option on the "/dev/shm" file system.
Additional Identifiers
Rule ID: SV-274180r1120528_rule
Vulnerability ID: V-274180
Group Title: SRG-OS-000368-GPOS-00154
Expert Comments
CCIs
| Number | Definition |
|---|---|
| CCI-001764 |
Prevent program execution in accordance with organization-defined policies, rules of behavior, and/or access agreements regarding software program usage and restrictions; rules authorizing the terms and conditions of software program usage. |
Controls
| Number | Title |
|---|---|
| CM-7(2) |
Prevent Program Execution |