OpenControls Logo

STIG Viewer

STIGViewer Support

SLEM 5 must prevent nonprivileged users from executing privileged functions, including disabling, circumventing, or altering implemented security safeguards/countermeasures.

Overview

Finding IDVersionRule IDIA ControlsSeverity
V-261371SLEM-05-431025SV-261371r996554_ruleCCI-002265medium
Description
Preventing nonprivileged users from executing privileged functions mitigates the risk that unauthorized individuals or processes may gain unnecessary access to information or privileges. Privileged functions include, for example, establishing accounts, performing system integrity checks, or administering cryptographic key management activities. Nonprivileged users are individuals who do not possess appropriate authorizations. Circumventing intrusion detection and prevention mechanisms or malicious code protection mechanisms are examples of privileged functions that require protection from nonprivileged users.
STIGDate
SUSE Linux Enterprise Micro (SLEM) 5 Security Technical Implementation Guide2025-05-08

Related Frameworks

1 mapping across 4 frameworks
SCF0 mappings

No source states a mapping between these directly.

Also reachable in 3 hops (11) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

DCH-05Cybersecurity & Data Protection Attributes
1.00
HRS-02Position Categorization
1.00
HRS-11Separation of Duties (SoD)
1.00
IAC-01Identity & Access Management (IAM)
1.00
IAC-01.2Authenticate, Authorize and Audit (AAA)
1.00
IAC-02Identification & Authentication for Organizational Users
1.00
IAC-03Identification & Authentication for Non-Organizational Users
1.00
IAC-04Identification & Authentication for Devices
1.00
IAC-05Identification & Authentication for Third-Party Technology Assets, Applications and/or Services (TAAS)
1.00
IAC-08Role-Based Access Control (RBAC)
1.00

+1 more (top 10 by confidence shown)

NIST 800-530 mappings

No source states a mapping between these directly.

Also reachable in 2 hops (1) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

AC-16Security and Privacy Attributes
1.00
CCI1 mapping
CCI-002265
1.00
NIST CSF 2.00 mappings

No source states a mapping between these directly.

Also reachable in 3 hops (1) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

PR.AA-05
1.00

Who does this work

8 NICE work roles and 6 EC-Council certifications.

This is an inference across published mappings, not a single claim by anyone. This check maps to a control, which maps to a Cybersecurity Framework outcome, which NIST assigns to the work roles below. EC-Council separately maps its certifications to those same roles.

A certification prepares someone for a role. It is not evidence that a holder is qualified, and neither NIST nor EC-Council has stated that any certification here addresses this check.

Work-role assignments published by NIST (NICE Framework Components 2.2.0 and the CSF 2.0 OLIR crosswalk). Certification mappings published by EC-Council.

Details

Check Text (C-261371r996554_chk)

Verify SLEM 5 prevents nonprivileged users from executing privileged functions, including disabling, circumventing, or altering implemented security safeguards/countermeasures. Obtain a list of authorized users (other than system administrator and guest accounts) for the system. Check the list against the system with the following command: > sudo semanage login -l | more Login Name SELinux User MLS/MCS Range Service __default__ user_u s0-s0:c0.c1023 * root unconfined_u s0-s0:c0.c1023 * system_u system_u s0-s0:c0.c1023 * joe staff_u s0-s0:c0.c1023 * All administrators must be mapped to the "sysadm_u", "staff_u", or an appropriately tailored confined role as defined by the organization. All authorized nonadministrative users must be mapped to the "user_u" role. If any interactive users are not mapped in this way, this is a finding.

Fix Text (F-65008r996553_fix)

Configure SLEM 5 to prevent nonprivileged users from executing privileged functions, including disabling, circumventing, or altering implemented security safeguards/countermeasures. Use the following command to map a new user to the "sysadm_u" role: > sudo semanage login -a -s sysadm_u <username> Use the following command to map an existing user to the "sysadm_u" role: > sudo semanage login -m -s sysadm_u <username> Use the following command to map a new user to the "staff_u" role: > sudo semanage login -a -s staff_u <username> Use the following command to map an existing user to the "staff_u" role: > sudo semanage login -m -s staff_u <username> Use the following command to map a new user to the "user_u" role: > sudo semanage login -a -s user_u <username> Use the following command to map an existing user to the "user_u" role: > sudo semanage login -m -s user_u <username>