Hidden extended file attributes must not exist on the system.
Overview
| Finding ID | Version | Rule ID | IA Controls | Severity |
|---|---|---|---|---|
| V-226421 | GEN000000-SOL00420 | SV-226421r603265_rule | Medium |
| Description |
|---|
| Solaris extended attributes are essentially files themselves that are of an arbitrary size and content. They could be used to hide files from ordinary system file scans. |
| STIG | Date |
|---|---|
| Solaris 10 SPARC Security Technical Implementation Guide | 2022-09-07 |
Details
| Check Text ( C-28582r482624_chk ) |
|---|
| Search for all files with hidden extended attributes. # find / -xattr -print -exec runat {} ls -al \; If hidden extended file attributes exist, this is a finding. |
| Fix Text (F-28570r482625_fix) |
|---|
| Remove the hidden extended file attributes. # runat |