DG0019-ORACLE11 - Application software should be owned by a Software Application account - 'Oracle base directory file permissions are correct'

Information

File and directory ownership imparts full privileges to the owner. These privileges should be restricted to a single, dedicated account to preserve proper chains of ownership and privilege assignment management.

Solution

Assign DBMS file and directory ownership to a dedicated Oracle OS owner account.

Document the locations of Oracle DBMS files and directories in the System Security Plan.

On Windows systems:

The creation of a dedicated Oracle OS account and change of ownership of all files in the %ORACLE_HOME% directories and subdirectories should be performed prior to placing the DBMS system into production.

See checks DO0120 and DG0102 for details on establishing a dedicated OS account for Oracle services on Windows platforms.

Using the dedicated Oracle OS owner account to install and maintain the DBMS software libraries and configuration files will help maintain file and directory ownership.

On UNIX systems:

Assign DBMS file and directory ownership to a dedicated Oracle host OS software installation and maintenance account.

The owner and group ownership as well as file permissions for the following files (if present) should not be changed:

extjob
jssu
nmb
nmhs
nmo
oradism
externaljob.ora
coraenv
dbhome
oraenv

Using the dedicated Oracle host OS software installation and maintenance account to install and maintain the DBMS software libraries and configuration files will help maintain file and directory ownership.

See Also

https://dl.dod.cyber.mil/wp-content/uploads/stigs/zip/U_Oracle_Database_11g_Y21M10_STIG.zip

Item Details

Category: CONFIGURATION MANAGEMENT

References: 800-53|CM-6b., CAT|III, Rule-ID|SV-24363r1_rule, STIG-ID|DG0019-ORACLE11, Vuln-ID|V-3805

Plugin: Windows

Control ID: 1e4cd38c54ffb753da34134af997418ca118720982bc9f7d672a98f5b632566a