AC-06(08) Privilege Levels for Code Execution
NIST SP 800-53 (controls) 5.2.0 against 5.2.0
All changes in this version
All changes in this version
Title
Privilege Levels for Code Execution
Control
Prevent the following software from executing at higher privilege levels than users executing the software: [Assignment: software].
Discussion
In certain situations, software applications or programs need to execute with elevated privileges to perform required functions. However, depending on the software functionality and configuration, if the privileges required for execution are at a higher level than the privileges assigned to organizational users invoking such applications or programs, those users may indirectly be provided with greater privileges than assigned.
Parameters
ac-06.08_odp: software
Assessment objective
AC-06(08) [Assignment: software] is prevented from executing at higher privilege levels than users executing the software.
STIG rules that implement this control 7
Apple iOS/iPadOS 26 V1R3
- AIOS-26-009700 CAT II Apple iOS/iPadOS 26 must not allow non-DOD applications to access DOD data.
Apple iOS/iPadOS 27 V1R1
- AIOS-27-008800 CAT II Apple iOS/iPadOS 27 must not allow non-DoW applications to access DoW data.
Application Security and Development V6R5
- APSC-DV-000510 CAT I The application must execute without excessive account permissions.
Canonical Ubuntu 22.04 LTS V2R10
- UBTU-22-654230 CAT II Ubuntu 22.04 LTS must prevent all software from executing at higher privilege levels than users executing the software and the audit system must be configured to audit the execution of privileged functions.
Canonical Ubuntu 24.04 LTS V1R7
- UBTU-24-200580 CAT II Ubuntu 24.04 LTS must prevent all software from executing at higher privilege levels than users executing the software and the audit system must be configured to audit the execution of privileged functions.
Red Hat Enterprise Linux 10 V1R3
- RHEL-10-500300 CAT II RHEL 10 must generate audit records for successful and unsuccessful uses of the "execve" system call.
Red Hat Enterprise Linux 9 V2R10
- RHEL-09-654010 CAT II RHEL 9 must audit uses of the "execve" system call.