Ensure root PATH Integrity

MediumLevel 2Manual reviewcos

Description

The root user can execute any command on the system and could be fooled into executing programs unintentionally if the PATH is not set correctly. Including the current working directory (.) or other writable directory in root 's executable path makes it likely that an attacker can gain superuser access by forcing an administrator operating as root to execute a Trojan horse program.

How it is checked

Audit method: Manual review

This recommendation cannot be checked automatically. A scan lists it with these instructions when you pass --include-manual.

Run the following script and verify no results are returned: #!/bin/bash PATH="$(sudo -Hiu root env | grep '^PATH' | cut -d= -f2)" echo "$PATH" | grep -q "::" && echo "Empty directory in PATH (::)" echo "$PATH" | grep -q ":$" && echo "Trailing : in PATH" for dir in $(echo "$PATH" | tr ":" " "); do if [ -d "$dir" ]; then ls -ldH "$dir" | awk 'substr($1,6,1) != "-" {print $9, "is group writable"} substr($1,9,1) != "-" {print $9, "is world writable"} $3 != "root" {print $9, "is not owned by root"}' else base_dir=$(echo "$dir" | cut -d "/" -f2) # Ignore if directory is on read-only partition rw=$(findmnt -T "/$base_dir" | sed '1d' | grep -v "\sro,") if [ -n "$rw" ]; then echo "$dir is not a directory" fi fi done

How it is fixed

Fix method: Guidance or infrastructure patch

Correct or justify any items discovered in the Audit step.

Properties

Operating systems: Any
Tags: container-optimized-oscos
Reference: CIS Google Container-Optimized OS Benchmark v1.2.0 - 6.2.6 Ensure root PATH Integrity