Ensure that unauthorized images are not installed with privilege.

Violation reports

Description

Installation of an executable image with privilege allows unprivileged users to perform privileged operations when running the program. Such programs must be carefully constructed to ensure that only the designed functions can be performed. Installation of a program with privilege when it was not designed to be installed with privilege is a major security hazard. This test can be used to ensure that only authorized programs are installed with privilege.

Exemptions within the (DISK, CHECKSUM) element specify checksum values for particular files on disk. The test for the CHECKSUM constraint within this facility determines whether such an exemption has been established for all files on the system that are installed with privilege.

Thus, it can be set once for each possible privilege. When using the Command Interface if you do not specify a selector when changing the limit or exemptions your change applies to all privileges.

Limits

Exemptions

The test ABSOLUTHI is sufficient to express simpler limitations based on privilege level.

If a more complicated selection of privileges is required, it may be necessary to use the test PRIVPROHIB. 

Ensure that unauthorized images are not installed as protected.

Violation reports

Description

Installation of a shareable image as protected enables any user-written system services it contains so they can execute in Executive or Kernel mode and thus gain access to privileges. This test can be used to ensure that only authorized programs are installed as protected.

Exemptions within the (DISK, CHECKSUM) element specify checksum values for particular files on disk. The test for the CHECKSUM constraint within this facility determines whether such an exemption has been established for all files on the system that are installed as protected.

Limits

Exemptions

Ensure that images are not installed from directories writable by unprivileged users.

Violation reports

Description

Installation of an image from a directory tree which can be written by an unprivileged user (that is, one without the privileges required to install images) allows that user to subvert the installation process by substituting a different image before the next system boot (since installation is generally done automatically on boot).

Limits

Exemptions

Ensure that images which can be written by unprivileged users are not installed.

Violation reports

Description

Installation of an image which can be written by an unprivileged user (that is, one without the privileges required to install images) allows that user to subvert the installation process by substituting a different image before the next system boot (since installation is generally done automatically on boot).

Limits

Exemptions

Ensure that protections on all mail files fall within the restrictions set by policy.

Violation reports

Description

If a mail file's protection setting is not restrictive enough, unauthorized users will be able to read, write, execute, or delete the mail file in question. If the setting is too restrictive, users generally find a less acceptable way of sharing information to get their job done. Typically, they share their password or make an unauthorized copy of the mail file somewhere else.

The purpose of this test is to ensure that mail file protection settings are within the limits set by the security manager.

The ABSOLUTLO and ABSOLUTHI tests measure the UIC-based protection mask directly. The PERCENTLO and PERCENTHI tests measure the result of protection (including ACL protection) in terms of the percentage of usernames given access.

Violations for protection-related DISK facility elements are not reported regarding only the writeability of CDROM disks since the apparent writeability is just an illusion.

The mail file protection setting must allow at least the system to read and write the file. By default, the weakest acceptable mail file setting allows the system and owner to read and write the mail file. By default, other users are allowed NO access to the mail file.

By default, a minimum of 0 percent of user must have access and a maximum of 1 percent of users may have access. Customizing Limits for constraints ABSOLUTLO and ABSOLUTHI take the same form as a standard VMS file protection setting. The syntax for this is explained in some detail in VMS documentation. The default settings shown in the limits table below are good examples of how to specify which class of users are allowed which type of access. These are the codes involved:

• S=System account (or users with the SYSPRV privilege)
• O=Owner of the file
• G=Group (i.e., other users in the same UIC group as the owner)
• W=World (i.e., all other users)

• R=Read
• W=Write
• E=Execute
• D=Delete

Limits

Exemptions

Ensure that DECnotes conference files are protected within the limits set by the security policy.

Violation reports

Description

DECnotes conferences have special protection setting requirements in order to remain secure. Although nominally such conferences can be written to by multiple users, the secure method of using DECnotes involves forcing use of the DECnotes server so that modification of conference files is only done through the DECnotes software rather than some other program possible written for the purpose.

The purpose of this test is to ensure that DECnotes server use is required in order to write to conferences.

The ABSOLUTLO and ABSOLUTHI tests measure the UIC-based protection mask directly. The PERCENTLO and PERCENTHI tests measure the result of protection (including ACL protection) in terms of the percentage of usernames given access.

Violations for protection-related DISK facility elements are not reported regarding only the writeability of CDROM disks since the apparent writeability is just an illusion.

Notes files are owned by a system UIC.

By default, a minimum of 0 percent of users must have access and a maximum of 10 percent of users may have access. Customizing Minimum and maximum settings (i.e., least protective and most protective settings) can be set by using the same syntax as that used for file protection. See the default settings in the limits table below for examples of the syntax used in these settings. For details, see the VMS documentation set. selector Limits for constraints PERCENTLO and PERCENTHI can take a selector consisting of a VMS file access type: READ, WRITE, EXECUTE, DELETE or CONTROL. If no selector is specified, customization commands apply to all possible selector values.

Limits

Exemptions

Ensure that the ownership of each disk volume complies with the security policy.

Violation reports

Description

If an individual user is the owner of a disk volume, he can make it unavailable to other users, which is not the usual arrangement in timesharing systems. On the other hand, he can make it available to other users to store their data, but the owner of the disk is the de facto owner of that data, regardless of whether its creators are aware of that. To meet special needs, this can be a desirable situation, but the security manager should be aware of it.

The purpose of this test is to make sure that the security manager is aware of any disks that have non-system ownership.

For limits only (not exemptions), owner matching string of [SYSTEM] will match (as a special case) against UIC's which are represented as [1,4] (due, for instance, to absence of a Rights Database (RIGHTSLIST.DAT)).

Limits

Exemptions