Ensure root PATH Integrity

HighLevel 1Automatedsolaris

Description

The root user can execute any command on the system and could be tricked into executing programs if the PATH is not set correctly. Including the current working directory (.) or any other writable directory in root's executable path makes it likely that an attacker can gain superuser access by forcing an administrator operating as root to execute a malcode, such as a Trojan horse program. Audit: root's login PATH must not contain ::, a trailing :, '.', or group/other writable directories.

How it is checked

Audit method: Shell command

shell

p=$(su - root -c 'echo $PATH' 2>/dev/null | tail -n 1); [ -n "$p" ] || exit 1; r=compliant; case "$p" in *::*) r="Empty Directory in PATH (::)";; *:) r="Trailing : in PATH";; esac; IFS=:; set -- $p; unset IFS; for d in "$@"; do [ "$d" = . ] && r="PATH contains ."; if [ -d "$d" ]; then s=$(ls -ld "$d/" | awk 'substr($1,6,1)!="-" {print "Group Write permission set on directory"} substr($1,9,1)!="-" {print "Other Write permission set on directory"}' | head -n 1); [ -z "$s" ] || r="$s $d"; fi; done; echo "$r"

Expected output: compliant

How it is fixed

Fix method: Guidance or infrastructure patch

Correct or justify any items discovered in the Audit step.

Properties

Operating systems: Any
Tags: solarisaccounts
Reference: CIS Oracle Solaris 11.4 Benchmark v1.1.0 - 9.8 Ensure root PATH Integrity

Check this host

Run this on a machine you are allowed to audit. The scan is read-only.

shell

tmaegis scan --target solaris