Solaris 10 X86 Security Technical Implementation Guide

The Solaris 10 X86 Security Technical Implementation Guide (V2 R4) has 513 STIG checks. New to STIG checklists? Read What is a STIG checklist?, CKL vs CKLB, and STIG vs SCAP benchmark.

Find STIG checks

513STIG checks

Search filters this STIG's checks locally. Separate terms must all match (use quotes for an exact phrase). A search you ran on the Search page carries over here.

Severity

Version

V2 · R4

CurrentPublished Thu Jan 26 2023

The limitpriv zone option must be set to the vendor default or less permissive.

Solaris 10 X86 Security Technical Implementation Guide

Assessment Title

Rule Text

The limitpriv zone option must be set to the vendor default or less permissive.

Description

Discussion Text

Solaris zones can be assigned privileges generally reserved for the global zone using the limitpriv zone option. Any privilege assignments in excess of the vendor defaults may provide the ability for a non-global zone to compromise the global zone.

New to STIG checklists? Read What is a STIG checklist? and CKL vs CKLB.

Objective

V-227554

Rule

SV-227554r603266_rule

Severity

medium

Rule Version

GEN000000-SOL00640

Documentable

false

IA Controls

NIST SP 800-53

Rev 5

Assessment Procedure

Check Text

If the system is not a global zone, this vulnerability is not applicable.
List the non-global zones on the system.
# zoneadm list -vi
List the configuration for each zone.
# zonecfg -z <zone> info
Check the limitpriv lines.  If a line set other than default, this is a finding.  If limitpriv is not set, this is not a finding.

Implementation Procedure

Fix Text

Change the limitpriv setting to default.
# zonecfg -z <zone> set limitpriv=default

STIG check 77 of 513 in the Solaris 10 X86 STIG checklist

← Previous · V-227553The inherit-pkg-dir zone option must be set to none or the system default list defined for sparse root zones.Next · V-227555 →The physical devices must not be assigned to non-global zones.