ONTAP must be configured to enforce organization-defined mandatory access control policies over all subjects and objects.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-246941	NAOT-CM-000004	SV-246941r769155_rule		Medium

Description
Mandatory access control policies constrain what actions subjects can take with information obtained from data objects for which they have already been granted access, thus preventing the subjects from passing the information to unauthorized subjects and objects. This class of mandatory access control policies also constrains what actions subjects can take with respect to the propagation of access control privileges; that is, a subject with a privilege cannot pass that privilege to other subjects. Enforcement of mandatory access control is typically provided via an implementation that meets the reference monitor concept. The reference monitor enforces (mediates) access relationships between all subjects and objects based on privilege and need to know. The mandatory access control policies are defined uniquely for each network device, so they cannot be specified in the requirement. An example of where mandatory access control may be needed is to prevent administrators from tampering with audit objects.

Description

Mandatory access control policies constrain what actions subjects can take with information obtained from data objects for which they have already been granted access, thus preventing the subjects from passing the information to unauthorized subjects and objects. This class of mandatory access control policies also constrains what actions subjects can take with respect to the propagation of access control privileges; that is, a subject with a privilege cannot pass that privilege to other subjects. Enforcement of mandatory access control is typically provided via an implementation that meets the reference monitor concept. The reference monitor enforces (mediates) access relationships between all subjects and objects based on privilege and need to know. The mandatory access control policies are defined uniquely for each network device, so they cannot be specified in the requirement. An example of where mandatory access control may be needed is to prevent administrators from tampering with audit objects.

STIG	Date
NetApp ONTAP DSC 9.x Security Technical Implementation Guide	2021-07-28

Details

Check Text ( C-50373r769153_chk )
Use "security login show" to see all configured users and their roles. Use "security login role show" to see specific commands allowed for each role. If ONTAP cannot be configured to enforce organization-defined mandatory access control policies over all subjects and objects, this is a finding.

Fix Text (F-50327r769154_fix)
Configure roles with "security login role create -role " to create new roles, and "security login create -user-or-group-name -role " to assign the role to a specific user or group.