SV-226962r603265: All .Xauthority files must have mode 0600 or less permissive. | Solaris 10 SPARC STIG SCAP Benchmark

Loading benchmark…

Assessment Title

Rule Text

All .Xauthority files must have mode 0600 or less permissive.

Description

Discussion Text

.Xauthority files ensure the user is authorized to access the specific X Windows host. Excessive permissions may permit unauthorized modification of these files, which could lead to Denial of Service to authorized access or allow unauthorized access to be obtained.

How this relates to the STIG checklist: STIG vs SCAP benchmark.

IA Controls

NIST SP 800-53

Not mappedCCI-000366V-12014SV-12515

References

DPMS Target Solaris 10 SPARC DISA DPMS Target Solaris 10 SPARC 4060

Checks

DISA STIG (Manual Reference)

Check the file permissions for the .Xauthority files in the home directories of users of X.

Procedure:
# cd ~<X user>
# ls -lL .Xauthority

If the file mode is more permissive than 0600, this is finding.

SCC Automation Reference

The reconstructed evaluation script behind this rule's OVAL check(s) — every module a compound check combines, with this rule's own concrete values and DISA's SCC tool's real per-module mechanism curated from static teardown of SCC releases.

Assessment Script Powered by AISandbox-executed

A standalone Shell script to assess this control automatically. Review before running it in your environment.

Syntax-checked and actually executed in an isolated sandbox (not the real system this checks) — confirmed to run without errors.

#!/bin/sh
# This script implements the OVAL definition oval:mil.disa.fso.solaris11:def:297


check_xauthority_mode() {
  for home in $(getent passwd | cut -d: -f6); do
    if [ -f "$home/.Xauthority" ]; then
      mode=$(stat -c "%a %A" "$home/.Xauthority")
      if [ "$mode" != "600 -rw-------" ]; then
        echo "FAIL"
        exit 1
      fi
    fi
  done
}

check_xauthority_mode
echo "PASS"
exit 0

Remediation

Change the mode of the .Xauthority files.

Procedure:
# chmod 0600 .Xauthority