Ensure Group Write Access for the Document Root Directories and Files Is Properly Restricted

c=${APACHE_CONF:-}; if [ -z "$c" ]; then for f in /etc/apache2/apache2.conf /etc/httpd/conf/httpd.conf /usr/local/apache2/conf/httpd.conf /etc/apache2/httpd.conf; do [ -f "$f" ] && { c=$f; break; }; done; fi; [ -r "$c" ] || exit 1; R=$(awk 'tolower($1)=="serverroot"{v=$2; gsub(/"/,"",v); print v; exit}' "$c"); [ -n "$R" ] || R=$(dirname "$c"); shopt -s nocasematch; inc(){ local p g l; [ ${#FUNCNAME[@]} -lt 16 ] || return 0; p=$1; case $p in /*) ;; *) p=$R/$p;; esac; [ -d "$p" ] && p="$p/*"; for g in $p; do [ -f "$g" ] || continue; while IFS= read -r l || [ -n "$l" ]; do if [[ $l =~ ^[[:space:]]*include(optional)?[[:space:]]+\"?([^\"[:space:]]+) ]]; then inc "${BASH_REMATCH[2]}"; else printf '%s\n' "$l"; fi; done < "$g"; done; }; cfg=$(inc "$c" | sed -e 's/^[[:space:]]*//' -e '/^#/d' -e '/^$/d'); shopt -u nocasematch; ev(){ case $1 in '${'*'}') local n=${1#??}; n=${n%?}; local v; v=$(sed -n "s/^[[:space:]]*export[[:space:]]*$n=//p" "${APACHE_ENVVARS:-/etc/apache2/envvars}" 2>/dev/null | tail -n1 | tr -d "\"'"); printf '%s\n' "${v:-$1}";; *) printf '%s\n' "$1";; esac; }; g=$(ev "$(printf '%s\n' "$cfg" | awk 'tolower($1)=="group"{v=$2} END{print v}')"); getent group "$g" >/dev/null || { echo noncompliant; exit 0; }; n=0; while IFS= read -r dr; do dr=${dr//\"/}; [ -d "$dr" ] || continue; k=$(find -L "$dr" -group "$g" -perm /g=w -print 2>/dev/null | wc -l); n=$((n+k)); done < <(printf '%s\n' "$cfg" | awk 'tolower($1)=="documentroot"{print $2}'); echo $n

tmaegis scan --target apache