Ensure root PATH Integrity

MediaNivel 2Revisión manualcos

Descripción

The root user can execute any command on the system and could be fooled into executing programs unintentionally if the PATH is not set correctly. Including the current working directory (.) or other writable directory in root 's executable path makes it likely that an attacker can gain superuser access by forcing an administrator operating as root to execute a Trojan horse program.

Cómo se verifica

Método de auditoría: Revisión manual

Esta recomendación no se puede verificar automáticamente. Un escaneo la lista con estas instrucciones cuando se pasa --include-manual.

Run the following script and verify no results are returned: #!/bin/bash PATH="$(sudo -Hiu root env | grep '^PATH' | cut -d= -f2)" echo "$PATH" | grep -q "::" && echo "Empty directory in PATH (::)" echo "$PATH" | grep -q ":$" && echo "Trailing : in PATH" for dir in $(echo "$PATH" | tr ":" " "); do if [ -d "$dir" ]; then ls -ldH "$dir" | awk 'substr($1,6,1) != "-" {print $9, "is group writable"} substr($1,9,1) != "-" {print $9, "is world writable"} $3 != "root" {print $9, "is not owned by root"}' else base_dir=$(echo "$dir" | cut -d "/" -f2) # Ignore if directory is on read-only partition rw=$(findmnt -T "/$base_dir" | sed '1d' | grep -v "\sro,") if [ -n "$rw" ]; then echo "$dir is not a directory" fi fi done

Cómo se corrige

Método de corrección: Guía o parche de infraestructura

Correct or justify any items discovered in the Audit step.

Propiedades

Sistemas operativos: Cualquiera
Etiquetas: container-optimized-oscos
Referencia: CIS Google Container-Optimized OS Benchmark v1.2.0 - 6.2.6 Ensure root PATH Integrity