UCF STIG Viewer Logo
Changes are coming to https://stigviewer.com. Take our survey to help us understand your usage and how we can better serve you in the future.
Take Survey

The operator must document all file system objects that have non-standard access control list settings.


Overview

Finding ID Version Rule ID IA Controls Severity
V-48029 SOL-11.1-070260 SV-60901r1_rule Medium
Description
Access Control Lists allow an object owner to expand permissions on an object to specific users and groups in addition to the standard permission model. Non-standard Access Control List settings can allow unauthorized users to modify critical files.
STIG Date
Solaris 11 X86 Security Technical Implementation Guide 2015-06-26

Details

Check Text ( C-50465r1_chk )
The root role is required.

Identify all file system objects that have non-standard access control lists enabled.

# find / \( -fstype nfs -o -fstype cachefs -o -fstype autofs \
-o -fstype ctfs -o -fstype mntfs -o -fstype objfs \
-o -fstype proc \) -prune -o -acl -ls

This command should return no output. If output is created, this is a finding.

If the files are approved to have ACLs by organizational security policy, document the files and the reason that ACLs are required.
Fix Text (F-51641r1_fix)
The root role is required.

Remove ACLs that are not approved in the security policy.

For ZFS file systems, remove all extended ACLs with the following command:

# chmod A- [filename]

For UFS file systems

Determine the ACLs that are set on a file:

# getfacl [filename]

Remove any ACL configurations that are set:

# setfacl -d [ACL] [filename]