STIGQter: STIG Summary: Solaris 10 SPARC Security Technical Implementation Guide Version: 2 Release: 2 Benchmark Date: 22 Jan 2021:

Device files and directories must only be writable by users with a system account or as configured by the vendor.

DISA Rule

SV-226573r603265_rule

Vulnerability Number

V-226573

Group Title

SRG-OS-000480

Rule Version

GEN002280

Severity

CAT II

CCI(s)

CCI-000366 - The organization implements the security configuration settings.

Weight

Fix Recommendation

Remove the world-writable permission from the device file(s).

Procedure:
# chmod o-w <device file>

Document all changes.

Check Contents

Find all device files existing anywhere on the system.

Procedure:
# find / -type b -print > devicelist
# find / -type c -print >> devicelist

Check the permissions on the directories above subdirectories containing device files.

The following list of device files are intended to be world-writable and if present are not a finding.

/dev/arp
/dev/conslog
/dev/crypto
/dev/dtrace/dtrace
/dev/dtrace/helper
/dev/dtrace/provider/fasttrap
/dev/fd/*
/dev/kstat
/dev/null
/dev/poll
/dev/pool
/dev/ptmx
/dev/sad/user
/dev/tcp
/dev/tcp6
/dev/ticlts
/dev/ticots
/dev/ticotsord
/dev/tty
/dev/udp
/dev/udp6
/dev/zero
/dev/zfs

If any device file or their parent directory is world-writable and it is not intended to be world-writable, this is a finding.

Device files and directories must only be writable by users with a system account or as configured by the vendor.

DISA Rule

Vulnerability Number

Group Title

Rule Version

Severity

CCI(s)

Weight

Fix Recommendation

Check Contents

Vulnerability Number

Documentable

Rule Version

Severity Override Guidance

Check Content Reference

Target Key

Comments