STIGQter: STIG Summary: Oracle Linux 6 Security Technical Implementation Guide Version: 2 Release: 3 Benchmark Date: 23 Apr 2021:

The noexec option must be added to removable media partitions.

DISA Rule

SV-219565r603263_rule

Vulnerability Number

V-219565

Group Title

SRG-OS-000480

Rule Version

OL6-00-000271

Severity

CAT III

CCI(s)

• CCI-000366 - The organization implements the security configuration settings.

Weight

10

Fix Recommendation

The "noexec" mount option prevents the direct execution of binaries on the mounted filesystem. Users should not be allowed to execute binaries that exist on partitions mounted from removable media (such as a USB key). The "noexec" option prevents code from being executed directly from the media itself, and may therefore provide a line of defense against certain types of worms or malicious code. Add the "noexec" option to the fourth column of "/etc/fstab" for the line which controls mounting of any removable media partitions.

Check Contents

Identify any removable media that is configured on the system:

# cat /etc/fstab

/dev/mapper/vg_rhel6-lv_root / ext4 defaults 1 1
UUID=0be9b205-f8e6-4bf4-b0ba-1f235fc55936 /boot ext4 defaults 1 2
UUID=5D49-30B2 /boot/efi vfat umask=0077,shortname=winnt 0 0
/dev/mapper/vg_rhel6-lv_home /home ext4 defaults 1 2
/dev/mapper/vg_rhel6-lv_tmp /tmp ext4 defaults 1 2
/dev/mapper/vg_rhel6-lv_var /var ext4 defaults 1 2
/dev/mapper/vg_rhel6-lv_swap swap swap defaults 0 0
tmpfs /dev/shm tmpfs defaults 0 0
devpts /dev/pts devpts gid=5,mode=620 0 0
sysfs /sys sysfs defaults 0 0
proc /proc proc defaults 0 0
/dev/sdc1 /media/usb vfat defaults,rw,noexec 0 0

If any of the identified removable media devices do not have "noexec" defined, this is a finding.

Vulnerability Number

V-219565

Documentable

False

Rule Version

OL6-00-000271

Severity Override Guidance

Identify any removable media that is configured on the system:

# cat /etc/fstab

/dev/mapper/vg_rhel6-lv_root / ext4 defaults 1 1
UUID=0be9b205-f8e6-4bf4-b0ba-1f235fc55936 /boot ext4 defaults 1 2
UUID=5D49-30B2 /boot/efi vfat umask=0077,shortname=winnt 0 0
/dev/mapper/vg_rhel6-lv_home /home ext4 defaults 1 2
/dev/mapper/vg_rhel6-lv_tmp /tmp ext4 defaults 1 2
/dev/mapper/vg_rhel6-lv_var /var ext4 defaults 1 2
/dev/mapper/vg_rhel6-lv_swap swap swap defaults 0 0
tmpfs /dev/shm tmpfs defaults 0 0
devpts /dev/pts devpts gid=5,mode=620 0 0
sysfs /sys sysfs defaults 0 0
proc /proc proc defaults 0 0
/dev/sdc1 /media/usb vfat defaults,rw,noexec 0 0

If any of the identified removable media devices do not have "noexec" defined, this is a finding.

Check Content Reference

M

Target Key

2928

Comments