Add nosuid Option to /boot/efi

An XCCDF Rule

Description

The nosuid mount option can be used to prevent execution of setuid programs in /boot/efi. The SUID and SGID permissions should not be required on the boot partition. Add the nosuid option to the fourth column of /etc/fstab for the line which controls mounting of /boot/efi.

Rationale

The presence of SUID and SGID executables should be tightly controlled. Users should not be able to execute SUID or SGID binaries from boot partitions.

ID: xccdf_org.ssgproject.content_rule_mount_option_boot_efi_nosuid
Severity: Medium
References: CCI-000366 CCI-001764

CM-6(b) CM-6.1(iv)

SRG-OS-000480-GPOS-00227

SV-244530r1017337_rule
Updated: over 1 year ago

- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - DISA-STIG-RHEL-08-010572
  - NIST-800-53-CM-6(b)  - NIST-800-53-CM-6.1(iv)
  - configure_strategy
  - high_disruption
  - low_complexity
  - medium_severity
  - mount_option_boot_efi_nosuid
  - no_reboot_needed

- name: 'Add nosuid Option to /boot/efi: Check information associated to mountpoint'
  command: findmnt --fstab '/boot/efi'
  register: device_name
  failed_when: device_name.rc > 1
  changed_when: false
  when:
  - ( not ( "kernel" in ansible_facts.packages and "rpm-ostree" in ansible_facts.packages
    and "bootc" in ansible_facts.packages ) and not ( ansible_virtualization_type
    in ["docker", "lxc", "openvz", "podman", "container"] ) )
  - '"/boot/efi" in ansible_mounts | map(attribute="mount") | list'
  tags:
  - DISA-STIG-RHEL-08-010572
  - NIST-800-53-CM-6(b)
  - NIST-800-53-CM-6.1(iv)
  - configure_strategy
  - high_disruption
  - low_complexity
  - medium_severity
  - mount_option_boot_efi_nosuid
  - no_reboot_needed

- name: 'Add nosuid Option to /boot/efi: Create mount_info dictionary variable'
  set_fact:
    mount_info: '{{ mount_info|default({})|combine({item.0: item.1}) }}'
  with_together:
  - '{{ device_name.stdout_lines[0].split() | list | lower }}'
  - '{{ device_name.stdout_lines[1].split() | list }}'
  when:
  - ( not ( "kernel" in ansible_facts.packages and "rpm-ostree" in ansible_facts.packages
    and "bootc" in ansible_facts.packages ) and not ( ansible_virtualization_type
    in ["docker", "lxc", "openvz", "podman", "container"] ) )
  - '"/boot/efi" in ansible_mounts | map(attribute="mount") | list'
  - device_name.stdout is defined and device_name.stdout_lines is defined
  - (device_name.stdout | length > 0)
  tags:
  - DISA-STIG-RHEL-08-010572
  - NIST-800-53-CM-6(b)
  - NIST-800-53-CM-6.1(iv)
  - configure_strategy
  - high_disruption
  - low_complexity
  - medium_severity
  - mount_option_boot_efi_nosuid
  - no_reboot_needed

- name: 'Add nosuid Option to /boot/efi: If /boot/efi not mounted, craft mount_info
    manually'
  set_fact:
    mount_info: '{{ mount_info|default({})|combine({item.0: item.1}) }}'
  with_together:
  - - target
    - source
    - fstype
    - options
  - - /boot/efi
    - ''
    - ''
    - defaults
  when:
  - ( not ( "kernel" in ansible_facts.packages and "rpm-ostree" in ansible_facts.packages
    and "bootc" in ansible_facts.packages ) and not ( ansible_virtualization_type
    in ["docker", "lxc", "openvz", "podman", "container"] ) )
  - '"/boot/efi" in ansible_mounts | map(attribute="mount") | list'
  - ("--fstab" | length == 0)
  - device_name.stdout is defined and device_name.stdout_lines is defined
  - (device_name.stdout | length == 0)
  tags:
  - DISA-STIG-RHEL-08-010572
  - NIST-800-53-CM-6(b)
  - NIST-800-53-CM-6.1(iv)
  - configure_strategy
  - high_disruption
  - low_complexity
  - medium_severity
  - mount_option_boot_efi_nosuid
  - no_reboot_needed

- name: 'Add nosuid Option to /boot/efi: Make sure nosuid option is part of the to
    /boot/efi options'
  set_fact:
    mount_info: '{{ mount_info | combine( {''options'':''''~mount_info.options~'',nosuid''
      }) }}'
  when:
  - ( not ( "kernel" in ansible_facts.packages and "rpm-ostree" in ansible_facts.packages
    and "bootc" in ansible_facts.packages ) and not ( ansible_virtualization_type
    in ["docker", "lxc", "openvz", "podman", "container"] ) )
  - '"/boot/efi" in ansible_mounts | map(attribute="mount") | list'
  - mount_info is defined and "nosuid" not in mount_info.options
  tags:
  - DISA-STIG-RHEL-08-010572
  - NIST-800-53-CM-6(b)
  - NIST-800-53-CM-6.1(iv)
  - configure_strategy
  - high_disruption
  - low_complexity
  - medium_severity
  - mount_option_boot_efi_nosuid
  - no_reboot_needed

- name: 'Add nosuid Option to /boot/efi: Ensure /boot/efi is mounted with nosuid option'
  mount:
    path: /boot/efi
    src: '{{ mount_info.source }}'
    opts: '{{ mount_info.options }}'
    state: mounted
    fstype: '{{ mount_info.fstype }}'
  when:
  - ( not ( "kernel" in ansible_facts.packages and "rpm-ostree" in ansible_facts.packages
    and "bootc" in ansible_facts.packages ) and not ( ansible_virtualization_type
    in ["docker", "lxc", "openvz", "podman", "container"] ) )
  - '"/boot/efi" in ansible_mounts | map(attribute="mount") | list'
  - mount_info is defined
  - (device_name.stdout is defined and (device_name.stdout | length > 0)) or ("--fstab"
    | length == 0)
  tags:
  - DISA-STIG-RHEL-08-010572
  - NIST-800-53-CM-6(b)
  - NIST-800-53-CM-6.1(iv)
  - configure_strategy
  - high_disruption
  - low_complexity
  - medium_severity
  - mount_option_boot_efi_nosuid
  - no_reboot_needed

# Remediation is applicable only in certain platforms
if ( ! ( { rpm --quiet -q kernel ;} && { rpm --quiet -q rpm-ostree ;} && { rpm --quiet -q bootc ;} ) && ! ( [ -f /.dockerenv ] || [ -f /run/.containerenv ] ) ) && { [ -d /sys/firmware/efi ]; }; then

function perform_remediation {
    
        # the mount point /boot/efi has to be defined in /etc/fstab        # before this remediation can be executed. In case it is not defined, the
        # remediation aborts and no changes regarding the mount point are done.
        mount_point_match_regexp="$(printf "^[[:space:]]*[^#].*[[:space:]]%s[[:space:]]" "/boot/efi")"

    grep "$mount_point_match_regexp" -q /etc/fstab \
        || { echo "The mount point '/boot/efi' is not even in /etc/fstab, so we can't set up mount options" >&2;
                echo "Not remediating, because there is no record of /boot/efi in /etc/fstab" >&2; return 1; }
    


    mount_point_match_regexp="$(printf "^[[:space:]]*[^#].*[[:space:]]%s[[:space:]]" /boot/efi)"

    # If the mount point is not in /etc/fstab, get previous mount options from /etc/mtab
    if ! grep -q "$mount_point_match_regexp" /etc/fstab; then
        # runtime opts without some automatic kernel/userspace-added defaults
        previous_mount_opts=$(grep "$mount_point_match_regexp" /etc/mtab | head -1 |  awk '{print $4}' \
                    | sed -E "s/(rw|defaults|seclabel|nosuid)(,|$)//g;s/,$//")
        [ "$previous_mount_opts" ] && previous_mount_opts+=","
        # In iso9660 filesystems mtab could describe a "blocksize" value, this should be reflected in
        # fstab as "block".  The next variable is to satisfy shellcheck SC2050.
        fs_type=""
        if [  "$fs_type" == "iso9660" ] ; then
            previous_mount_opts=$(sed 's/blocksize=/block=/' <<< "$previous_mount_opts")
        fi
        echo " /boot/efi  defaults,${previous_mount_opts}nosuid 0 0" >> /etc/fstab
    # If the mount_opt option is not already in the mount point's /etc/fstab entry, add it
    elif ! grep "$mount_point_match_regexp" /etc/fstab | grep -q "nosuid"; then
        previous_mount_opts=$(grep "$mount_point_match_regexp" /etc/fstab | awk '{print $4}')
        sed -i "s|\(${mount_point_match_regexp}.*${previous_mount_opts}\)|\1,nosuid|" /etc/fstab
    fi


    if mkdir -p "/boot/efi"; then
        if mountpoint -q "/boot/efi"; then
            mount -o remount --target "/boot/efi"
        fi
    fi
}

perform_remediation

else
    >&2 echo 'Remediation is not applicable, nothing was done'
fi

Add nosuid Option to /boot/efi

Description

Rationale

Remediation - Ansible

Remediation - Shell Script