OpenControls Logo

STIG Viewer

STIGViewer Support

All system command files must not have extended ACLs.

Overview

Finding IDVersionRule IDIA ControlsSeverity
V-215325AIX7-00-003009SV-215325r991560_ruleCCI-001499medium
Description
Restricting permissions will protect system command files from unauthorized modification. System command files include files present in directories used by the operating system for storing default system executables and files present in directories included in the system's default executable search paths.
STIGDate
IBM AIX 7.x Security Technical Implementation Guide2024-08-16

Related Frameworks

1 mapping across 3 frameworks
SCF0 mappings

No source states a mapping between these directly.

Also reachable in 3 hops (1) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

CHG-04.5Library Privileges
1.00
NIST 800-530 mappings

No source states a mapping between these directly.

Also reachable in 2 hops (56) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

AC-17(1)Monitoring and Control
1.00
AC-2(1)Automated System Account Management
1.00
AC-2(10)Shared and Group Account Credential Change
1.00
AC-2(2)Automated Temporary and Emergency Account Management
1.00
AC-2(3)Disable Accounts
1.00
AC-2(4)Automated Audit Actions
1.00
AC-3Access Enforcement
1.00
AC-3(7)Role-based Access Control
1.00
AC-4Information Flow Enforcement
1.00
AC-6(10)Prohibit Non-privileged Users from Executing Privileged Functions
1.00

+46 more (top 10 by confidence shown)

CCI1 mapping
CCI-001499
1.00

Details

Check Text (C-215325r991560_chk)

Verify all system command files have no extended ACLs by running the following commands: # aclget /etc # aclget /bin # aclget /usr/bin # aclget /usr/lbin # aclget /usr/ucb # aclget /sbin # aclget /usr/sbin If any of the command files have extended permissions enabled, this is a finding.

Fix Text (F-16521r294427_fix)

Remove the extended ACL(s) from the system command file(s) and set the extended permissions to disabled by running the following command: # acledit [command-path ]/[ command-file]