SV-230301r1184262: RHEL 8 must prevent special devices on non-root local partitions. | Red Hat Enterprise Linux 8 STIG SCAP Benchmark

Loading benchmark…

Assessment Title

Rule Text

RHEL 8 must prevent special devices on non-root local partitions.

Description

Discussion Text

The "nodev" mount option causes the system to not interpret character or block special devices. Executing character or block special devices from untrusted file systems increases the opportunity for nonprivileged users to attain unauthorized administrative access. The only legitimate location for device files is the /dev directory located on the root partition.

How this relates to the STIG checklist: STIG vs SCAP benchmark.

IA Controls

NIST SP 800-53

Not mappedCCI-000366

References

DPMS Target Red Hat Enterprise Linux 8 DISA DPMS Target Red Hat Enterprise Linux 8 2921

Checks

DISA STIG (Manual Reference)

Verify all nonroot local partitions are mounted with the "nodev" option with the following command:

$ sudo mount | grep '^/dev\S* on /\S' | grep --invert-match 'nodev'

If any output is produced, this is a finding.

SCC Automation Reference

The reconstructed evaluation script behind this rule's OVAL check(s) — every module a compound check combines, with this rule's own concrete values and DISA's SCC tool's real per-module mechanism curated from static teardown of SCC releases.

#!/bin/bash
# Reconstructed from oval:mil.disa.stig.rhel8os:def:230301
# RHEL 8 must prevent special devices on non-root local partitions.
# Per-module read mechanism curated from static teardown of DISA's SCC tool
# (SCAP Compliance Checker) -- see the SCC Automation Reference above.

# partition_object (partition_test)
test_1() {
  (findmnt -n -o OPTIONS '^/\S+$' | tr ',' '\n') | grep -qxF 'nodev'
}
# textfilecontent54_object (textfilecontent54_test)
test_2() {
  (sed -En 's/^\s*\/dev\S*\s+\/\S+\s+\S+\s+(\S+)\s+\S+\s+\S+\s*$/\1/p' '/etc/fstab') | grep -Pq '(?:^nodev$|^nodev,|,nodev$|,nodev,)'
}

if ( test_1 && test_2 ); then
  echo "PASS"
else
  echo "FAIL"
fi

Remediation

Configure the "/etc/fstab" to use the "nodev" option on all non-root local partitions.