STIGQter: STIG Summary: Oracle Linux 6 Security Technical Implementation Guide Version: 2 Release: 3 Benchmark Date: 23 Apr 2021:

The Oracle Linux operating system must mount /dev/shm with the nosuid option.

DISA Rule

SV-209074r603263_rule

Vulnerability Number

V-209074

Group Title

SRG-OS-000368

Rule Version

OL6-00-000531

Severity

CAT III

CCI(s)

• CCI-001764 - The information system prevents program execution in accordance with organization-defined policies regarding software program usage and restrictions, and/or rules authorizing the terms and conditions of software program usage.

Weight

10

Fix Recommendation

Configure the "/etc/fstab" to use the "nosuid" option for all lines containing "/dev/shm".

Check Contents

Verify that the "nosuid" option is configured for /dev/shm.

Check that the operating system is configured to use the "nosuid" option for /dev/shm with the following command:

# cat /etc/fstab | grep /dev/shm | grep nosuid

tmpfs /dev/shm tmpfs defaults,nodev,nosuid,noexec 0 0

If the "nosuid" option is not present on the line for "/dev/shm", this is a finding.

Verify "/dev/shm" is mounted with the "nosuid" option:

# mount | grep "/dev/shm" | grep nosuid

If no results are returned, this is a finding.

Vulnerability Number

V-209074

Documentable

False

Rule Version

OL6-00-000531

Severity Override Guidance

Verify that the "nosuid" option is configured for /dev/shm.

Check that the operating system is configured to use the "nosuid" option for /dev/shm with the following command:

# cat /etc/fstab | grep /dev/shm | grep nosuid

tmpfs /dev/shm tmpfs defaults,nodev,nosuid,noexec 0 0

If the "nosuid" option is not present on the line for "/dev/shm", this is a finding.

Verify "/dev/shm" is mounted with the "nosuid" option:

# mount | grep "/dev/shm" | grep nosuid

If no results are returned, this is a finding.

Check Content Reference

M

Target Key

2928

Comments