Hidden extended file attributes must not exist on the system.
Overview
| Finding ID | Version | Rule ID | IA Controls | Severity |
|---|---|---|---|---|
| V-227547 | GEN000000-SOL00420 | SV-227547r603266_rule | Medium |
| Description |
|---|
| Solaris extended attributes are essentially files themselves that are of an arbitrary size and content. They could be used to hide files from ordinary system file scans. |
| STIG | Date |
|---|---|
| Solaris 10 X86 Security Technical Implementation Guide | 2020-12-04 |
Details
| Check Text ( C-29709r488174_chk ) |
|---|
| Search for all files with hidden extended attributes. # find / -xattr -print -exec runat {} ls -al \; If hidden extended file attributes exist, this is a finding. |
| Fix Text (F-29697r488175_fix) |
|---|
| Remove the hidden extended file attributes. # runat |