← Back to SUSE Linux Enterprise Server v11 for System z Security Technical Implementation Guide

V-924

CAT II (Medium)

Device files and directories must only be writable by users with a system account or as configured by the vendor.

Rule ID

SV-45177r1_rule

STIG

SUSE Linux Enterprise Server v11 for System z Security Technical Implementation Guide

Version

V1R12

CCIs

CCI-000225

Discussion

System device files in writable directories could be modified, removed, or used by an unprivileged user to control system hardware.

Check Content

Find all world-writable device files existing anywhere on the system.

Procedure:
# find / -perm -2 -a \( -type b -o -type c \) > devicelist
Check the permissions on the directories above subdirectories containing device files. If any of the device files or their parent directories are world-writable, excepting device files specifically intended to be world-writable such as /dev/null, this is a finding.

Fix Text

Remove the world-writable permission from the device file(s).

Procedure:
# chmod o-w <device file>

Document all changes.