Check: RHEL-09-231105
RHEL 9 STIG:
RHEL-09-231105
(in versions v1 r3 through v1 r1)
Title
RHEL 9 must prevent files with the setuid and setgid bit set from being executed on the /boot/efi directory. (Cat II impact)
Discussion
The "nosuid" mount option causes the system not to execute "setuid" and "setgid" files with owner privileges. This option must be used for mounting any file system not containing approved "setuid" and "setguid" files. Executing files from untrusted file systems increases the opportunity for nonprivileged users to attain unauthorized administrative access. Satisfies: SRG-OS-000368-GPOS-00154, SRG-OS-000480-GPOS-00227
Check Content
Note: For systems that use BIOS, this requirement is Not Applicable. Verify the /boot/efi directory is mounted with the "nosuid" option with the following command: $ mount | grep '\s/boot/efi\s' /dev/sda1 on /boot/efi type vfat (rw,nosuid,relatime,fmask=0077,dmask=0077,codepage=437,iocharset=ascii,shortname=winnt,errors=remount-ro) If the /boot/efi file system does not have the "nosuid" option set, this is a finding.
Fix Text
Modify "/etc/fstab" to use the "nosuid" option on the "/boot/efi" directory.
Additional Identifiers
Rule ID: SV-257862r925573_rule
Vulnerability ID: V-257862
Group Title: SRG-OS-000368-GPOS-00154
Expert Comments
CCIs
| Number | Definition |
|---|---|
| CCI-000366 |
The organization implements the security configuration settings. |
| CCI-001764 |
The information system prevents program execution in accordance with organization-defined policies regarding software program usage and restrictions, and/or rules authorizing the terms and conditions of software program usage. |