The operator must document all file system objects that have non-standard access control list settings.
An XCCDF Rule
Description
Access Control Lists allow an object owner to expand permissions on an object to specific users and groups in addition to the standard permission model. Non-standard Access Control List settings can allow unauthorized users to modify critical files.
- ID
- SV-216441r959010_rule
- Version
- SOL-11.1-070260
- Severity
- Medium
- References
- Updated
Remediation Templates
A Manual Procedure
The root role is required.
Remove ACLs that are not approved in the security policy.
For ZFS file systems, remove all extended ACLs with the following command: