Check: RHEL-09-231100
RHEL 9 STIG:
RHEL-09-231100
(in versions v1 r3 through v1 r1)
Title
RHEL 9 must prevent files with the setuid and setgid bit set from being executed on the /boot directory. (Cat II impact)
Discussion
The "nosuid" mount option causes the system not to execute "setuid" and "setgid" files with owner privileges. This option must be used for mounting any file system not containing approved "setuid" and "setguid" files. Executing files from untrusted file systems increases the opportunity for nonprivileged users to attain unauthorized administrative access. Satisfies: SRG-OS-000368-GPOS-00154, SRG-OS-000480-GPOS-00227
Check Content
Note: For systems that use UEFI, this requirement is Not Applicable. Verify the /boot directory is mounted with the "nosuid" option with the following command: $ mount | grep '\s/boot\s' /dev/sda1 on /boot type xfs (rw,nosuid,relatime,seclabe,attr2,inode64,noquota) If the /boot file system does not have the "nosuid" option set, this is a finding.
Fix Text
Modify "/etc/fstab" to use the "nosuid" option on the "/boot" directory.
Additional Identifiers
Rule ID: SV-257861r925570_rule
Vulnerability ID: V-257861
Group Title: SRG-OS-000368-GPOS-00154
Expert Comments
CCIs
| Number | Definition |
|---|---|
| CCI-000366 |
The organization implements the security configuration settings. |
| CCI-001764 |
The information system prevents program execution in accordance with organization-defined policies regarding software program usage and restrictions, and/or rules authorizing the terms and conditions of software program usage. |