Title

Device files used for backup must only be readable and/or writable by root or the backup user. (Cat II impact)

Discussion

System backups could be accidentally or maliciously overwritten and destroy the ability to recover the system if a compromise should occur. Unauthorized users could also copy system files.

Check Content

Check the system for device files read/write enabled for users other than root or the backup user. Example: # find / \( -perm -0020 -o -perm -0040 -o -perm -0002 -o -perm -0004 \) -a \( -type b -o -type c -o -type n \) -exec ls -ld {} \; If any device files used for backup are read/write enabled for users other than root, this is a finding.

Fix Text

Use the chmod command to remove the read/write bit(s) from the backup device files. # chmod o-r <b/u device file name> # chmod o-w <b/u device file name> # chmod g-r <b/u device file name> # chmod g-w <b/u device file name> Document all changes.

Additional Identifiers

Rule ID: SV-38506r1_rule

Vulnerability ID: V-925

Group Title: GEN002300

Expert Comments

CCIs tied to check.

Controls tied to check. These are derived from the CCIs shown above.