Files executed through a mail aliases file must not have extended ACLs.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-22441	GEN004430	SV-37496r1_rule	ECLP-1	Medium

Description
Excessive permissions on files executed through a mail aliases file could result in modification by an unauthorized user, execution of malicious code, and/or system compromise.

STIG	Date
Red Hat Enterprise Linux 5 Security Technical Implementation Guide	2017-03-01

Details

Check Text ( C-36153r1_chk )
Examine the contents of the /etc/aliases file. Procedure: # more /etc/aliases Examine the aliases file for any utilized directories or paths. # ls -lL Check the permissions for any paths referenced. If the permissions include a '+', the file has an extended ACL. If the file has an extended ACL and it has not been documented with the IAO, this is a finding.

Fix Text (F-31404r1_fix)
Remove the extended ACL from the file. # setfacl --remove-all