STIGQter STIGQter: STIG Summary: Red Hat Enterprise Linux 7 Security Technical Implementation Guide Version: 2 Release: 6 Benchmark Date: 24 Jan 2020: The Red Hat Enterprise Linux operating system must mount /dev/shm with the noexec option.

DISA Rule

SV-95725r2_rule

Vulnerability Number

V-81013

Group Title

SRG-OS-000368-GPOS-00154

Rule Version

RHEL-07-021024

Severity

CAT III

CCI(s)

Weight

10

Fix Recommendation

Configure the system so that /dev/shm is mounted with the "noexec" option.

Check Contents

Verify that the "noexec" option is configured for /dev/shm:

# cat /etc/fstab | grep /dev/shm

tmpfs /dev/shm tmpfs defaults,nodev,nosuid,noexec 0 0

If any results are returned and the "noexec" option is not listed, this is a finding.

Verify "/dev/shm" is mounted with the "noexec" option:

# mount | grep "/dev/shm" | grep noexec

If no results are returned, this is a finding.

Vulnerability Number

V-81013

Documentable

False

Rule Version

RHEL-07-021024

Severity Override Guidance

Verify that the "noexec" option is configured for /dev/shm:

# cat /etc/fstab | grep /dev/shm

tmpfs /dev/shm tmpfs defaults,nodev,nosuid,noexec 0 0

If any results are returned and the "noexec" option is not listed, this is a finding.

Verify "/dev/shm" is mounted with the "noexec" option:

# mount | grep "/dev/shm" | grep noexec

If no results are returned, this is a finding.

Check Content Reference

M

Target Key

2777

Comments