Check: OL6-00-000530
Oracle Linux 6 STIG:
OL6-00-000530
(in versions v2 r7 through v1 r13)
Title
The Oracle Linux operating system must mount /dev/shm with the nodev option. (Cat III impact)
Discussion
The "nodev" mount option causes the system to not interpret character or block special devices. Executing character or block special devices from untrusted file systems increases the opportunity for unprivileged users to attain unauthorized administrative access.
Check Content
Verify that the "nodev" option is configured for /dev/shm. Check that the operating system is configured to use the "nodev" option for /dev/shm with the following command: # cat /etc/fstab | grep /dev/shm | grep nodev tmpfs /dev/shm tmpfs defaults,nodev,nosuid,noexec 0 0 If the "nodev" option is not present on the line for "/dev/shm", this is a finding. Verify "/dev/shm" is mounted with the "nodev" option: # mount | grep "/dev/shm" | grep nodev If no results are returned, this is a finding.
Fix Text
Configure the "/etc/fstab" to use the "nodev" option for all lines containing "/dev/shm".
Additional Identifiers
Rule ID: SV-209073r854333_rule
Vulnerability ID: V-209073
Group Title: SRG-OS-000368
Expert Comments
CCIs
Number | Definition |
---|---|
CCI-001764 |
The information system prevents program execution in accordance with organization-defined policies regarding software program usage and restrictions, and/or rules authorizing the terms and conditions of software program usage. |
Controls
Number | Title |
---|---|
CM-7 (2) |
Prevent Program Execution |