Check: OL6-00-000531
Oracle Linux 6 STIG:
OL6-00-000531
(in versions v2 r7 through v1 r13)
Title
The Oracle Linux operating system must mount /dev/shm with the nosuid option. (Cat III impact)
Discussion
The "nosuid" mount option causes the system to not execute "setuid" and "setgid" files with owner privileges. This option must be used for mounting any file system not containing approved "setuid" and "setguid" files. Executing files from untrusted file systems increases the opportunity for unprivileged users to attain unauthorized administrative access.
Check Content
Verify that the "nosuid" option is configured for /dev/shm. Check that the operating system is configured to use the "nosuid" option for /dev/shm with the following command: # cat /etc/fstab | grep /dev/shm | grep nosuid tmpfs /dev/shm tmpfs defaults,nodev,nosuid,noexec 0 0 If the "nosuid" option is not present on the line for "/dev/shm", this is a finding. Verify "/dev/shm" is mounted with the "nosuid" option: # mount | grep "/dev/shm" | grep nosuid If no results are returned, this is a finding.
Fix Text
Configure the "/etc/fstab" to use the "nosuid" option for all lines containing "/dev/shm".
Additional Identifiers
Rule ID: SV-209074r854334_rule
Vulnerability ID: V-209074
Group Title: SRG-OS-000368
Expert Comments
CCIs
Number | Definition |
---|---|
CCI-001764 |
The information system prevents program execution in accordance with organization-defined policies regarding software program usage and restrictions, and/or rules authorizing the terms and conditions of software program usage. |
Controls
Number | Title |
---|---|
CM-7 (2) |
Prevent Program Execution |