Skip to content
ATO Pathways
  Log In

Verify User Who Owns System.map Files

An XCCDF Rule

Description

The System.map files are symbol map files generated during the compilation of the Linux kernel. They contain the mapping between kernel symbols and their corresponding memory addresses. These files must be owned by root. To properly set the owner of /boot/System.map*, run the command: 

$ sudo chown root /boot/System.map*

Rationale

The purpose of System.map files is primarily for debugging and profiling the kernel. Unrestricted access to these files might disclose information useful to attackers and malicious software leading to more sophisticated exploitation.

ID
xccdf_org.ssgproject.content_rule_file_owner_systemmap
Severity
Low
References
Updated



Remediation - Shell Script


find -L /boot/ -maxdepth 1 -type f ! -uid 0 -regextype posix-extended -regex '^.*System\.map.*$' -exec chown -L 0 {} \;

Remediation - Ansible

- name: Find /boot/ file(s) matching ^.*System\.map.*$
  command: find -H /boot/ -maxdepth 1 -type f ! -uid 0 -regextype posix-extended -regex
    "^.*System\.map.*$"
  register: files_found
  changed_when: false
  failed_when: false