Navigate

Check: GEN004430

SUSE Linux Enterprise Server v11 for System z STIG: GEN004430 (in versions v1 r12 through v1 r9)

Title

Files executed through a mail aliases file must not have extended ACLs. (Cat II impact)

Discussion

Excessive permissions on files executed through a mail aliases file could result in modification by an unauthorized user, execution of malicious code, and/or system compromise.

Check Content

Examine the contents of the /etc/aliases file. Procedure: # more /etc/aliases Examine the aliases file for any utilized directories or paths. # ls -lL <file referenced from aliases> Check the permissions for any paths referenced. If the permissions include a '+', the file has an extended ACL. If the file has an extended ACL and it has not been documented with the IAO, this is a finding.

Fix Text

Remove the extended ACL from the file. # setfacl --remove-all <file referenced from aliases>

Additional Identifiers

Rule ID: SV-45854r1_rule

Vulnerability ID: V-22441

Group Title: GEN004430

Expert Comments

Expert comments are only available to logged-in users.

CCIs

CCIs tied to check.

Number	Definition
CCI-000225	The organization employs the concept of least privilege, allowing only authorized accesses for users (and processes acting on behalf of users) which are necessary to accomplish assigned tasks in accordance with organizational missions and business functions.

Controls

Controls tied to check. These are derived from the CCIs shown above.

Number	Title
AC-6	Least Privilege