SV-226903r603265: The root file system must employ journaling or another mechanism ensuring file system consistency. | Solaris 10 SPARC STIG SCAP Benchmark

Loading benchmark…

Assessment Title

Rule Text

The root file system must employ journaling or another mechanism ensuring file system consistency.

Description

Discussion Text

File system journaling, or logging, can allow reconstruction of file system data after a system crash, thus, preserving the integrity of data that may have otherwise been lost. Journaling file systems typically do not require consistent checks upon booting after a crash, which can improve system availability. Some file systems employ other mechanisms to ensure consistency which also satisfy this requirement.

How this relates to the STIG checklist: STIG vs SCAP benchmark.

IA Controls

NIST SP 800-53

Not mappedCCI-000366SV-40021V-4304

References

DPMS Target Solaris 10 SPARC DISA DPMS Target Solaris 10 SPARC 4060

Checks

DISA STIG (Manual Reference)

Logging should be enabled for those types of files systems that do not turn on logging by default. 

Procedure:
# mount -v

UFS, JFS, VXFS, HFS, XFS, reiserfs, EXT3 and EXT4 all turn logging on by default and will not be a finding. The ZFS file system uses other mechanisms to provide for file system consistency, and will not be a finding. For other file systems types, if the root file system does not have the 'logging' option, this is a finding. If the 'nolog' option is set on the root file system, this is a finding.

SCC Automation Reference

The reconstructed evaluation script behind this rule's OVAL check(s) — every module a compound check combines, with this rule's own concrete values and DISA's SCC tool's real per-module mechanism curated from static teardown of SCC releases.

#!/bin/bash
# Reconstructed from oval:mil.disa.fso.solaris11:def:236
# The root file system must employ journaling or another mechanism ensuring file system consistency.
# Per-module read mechanism curated from static teardown of DISA's SCC tool
# (SCAP Compliance Checker) -- see the SCC Automation Reference above.

# / supports journaling
# textfilecontent54_object (textfilecontent54_test)
test_1() {
  (sed -En 's/^[ 	]*[^# 	]+[ 	]+[^# 	]+[ 	]+\/[ 	]+([^# 	]+)[ 	]+/\1/p' '/etc/vfstab') | grep -Pq '^(ufs|jfs|vxfs|hfs|xfs|reiserfs|ext3|ext4|zfs)$'
}
# / nolog
# textfilecontent54_object (textfilecontent54_test)
test_2() {
  (sed -En 's/^[ 	]*[^# 	]+[ 	]+[^# 	]+[ 	]+\/[ 	]+[^# 	]+[ 	]+[^# 	]+[ 	]+[^# 	]+[ 	]+([^# 	]+)[ 	]*/\1/p' '/etc/vfstab') | grep -Pq 'nolog'
}

if ! ( test_1 && test_2 ); then
  echo "PASS"
else
  echo "FAIL"
fi

Assessment Script Powered by AISandbox-executed

A standalone Shell script to assess this control automatically. Review before running it in your environment.

Syntax-checked and actually executed in an isolated sandbox (not the real system this checks) — confirmed to run without errors.

#!/bin/sh
# OVAL Definition: oval:mil.disa.fso.solaris11:def:236
if [ ! -f "/etc/vfstab" ]; then echo "PASS"; exit 0; fi; \
awk '/^\/ /{print $NF}' /etc/vfstab | while read fs; do \
    [ $(echo "$fs" | grep -E '^(ufs|jfs|vxfs|hfs|xfs|reiserfs|ext3|ext4|zfs)$' | wc -l) -gt 0 ] && \
    [ $(grep -w "nolog" "/etc/vfstab" | wc -l) -eq 0 ] && echo "PASS"; exit 0; done; echo "FAIL"; exit 1;

Remediation

Implement file system journaling for the root file system, or use a file system using other mechanisms to ensure consistency.  If the root file system supports journaling, enable it.  If the file system does not support journaling or another mechanism to ensure consistency, a migration to a different file system will be necessary.