Check: OL6-00-000532
Oracle Linux 6 STIG:
OL6-00-000532
(in versions v2 r7 through v1 r13)
Title
The Oracle Linux operating system must mount /dev/shm with the noexec option. (Cat III impact)
Discussion
The "noexec" mount option causes the system to not execute binary files. This option must be used for mounting any file system not containing approved binary files as they may be incompatible. Executing files from untrusted file systems increases the opportunity for unprivileged users to attain unauthorized administrative access.
Check Content
Verify that the "noexec" option is configured for /dev/shm. Check that the operating system is configured to use the "noexec" option for /dev/shm with the following command: # cat /etc/fstab | grep /dev/shm | grep noexec tmpfs /dev/shm tmpfs defaults,nodev,nosuid,noexec 0 0 If the "noexec" option is not present on the line for "/dev/shm", this is a finding. Verify "/dev/shm" is mounted with the "noexec" option: # mount | grep "/dev/shm" | grep noexec If no results are returned, this is a finding.
Fix Text
Configure the "/etc/fstab" to use the "noexec" option for all lines containing "/dev/shm".
Additional Identifiers
Rule ID: SV-209075r854335_rule
Vulnerability ID: V-209075
Group Title: SRG-OS-000368
Expert Comments
CCIs
Number | Definition |
---|---|
CCI-001764 |
The information system prevents program execution in accordance with organization-defined policies regarding software program usage and restrictions, and/or rules authorizing the terms and conditions of software program usage. |
Controls
Number | Title |
---|---|
CM-7 (2) |
Prevent Program Execution |