Ensure root path integrity

MoyenneNiveau 1Automatiséelinux

Description

The PATH variable for the root user determines the directories the shell searches for executables when root runs a command that is not given as an absolute path. Its integrity depends on the ownership, permissions, and composition of the directories it lists.

Méthode de vérification

Méthode d'audit: Commande shell

shell

alt0() { o=$(bash -c '#!/usr/bin/env bash

{
   l_pmask="0022"
   l_root_path="$(su - root -c '"'"'printf "%s" "$PATH"'"'"')"
   grep -q  -- "::" <<< "$l_root_path" && echo " - root'"'"'s PATH contains an empty directory (::)"
   grep -Pq -- ":\h*$" <<< "$l_root_path" && echo " - root'"'"'s PATH ends with a trailing colon (:)"
   grep -Pq -- '"'"'(^\h*|:)\.(:|\h*$)'"'"' <<< "$l_root_path" && echo " - root'"'"'s PATH contains the current working directory (.)"
   IFS=":" read -ra a_path_loc <<< "$l_root_path"
   for l_path in "${a_path_loc[@]}"; do
      if [ -d "$l_path" ]; then
         while IFS=: read -r l_fmode l_fown; do
            [ "$l_fown" != "root" ] && echo " - Directory \"$l_path\" is owned by \"$l_fown\" (should be owned by root)"
            [ $(( l_fmode & l_pmask )) -gt 0 ] && echo " - Directory \"$l_path\" is mode \"$l_fmode\" (should be 0755 or more restrictive)"
         done <<< "$(stat -Lc '"'"'%#a:%U'"'"' "$l_path")"
      else
         echo " - \"$l_path\" is not an existing directory"
      fi
   done
}' 2>&1); [ -z "$o" ] || { echo "step1: $o" | head -c 300; return 1; }; }; if alt0; then echo compliant; fi

Sortie attendue: compliant

Méthode de correction

Méthode de correction: Recommandation ou correctif d'infrastructure

For each non-compliant item identified by the audit, correct root's PATH as follows. Edit the shell initialization file that sets root's PATH (for example /root/.bash_profile, /root/.bashrc, or the relevant file under /etc/profile.d/) and remove any current-working- directory (.) entry, any empty entry (::), and any trailing colon (:). For each directory in root's PATH that is not owned by root, run the following command to set its owner to root: # chown root <directory> For each directory in root's PATH that is writable by group or other, run the following command to remove those permissions so the mode is 0755 or more restrictive: # chmod 0755 <directory> For each PATH entry that does not …

Propriétés

Systèmes d'exploitation: rocky-9
Étiquettes: cis-convertedlinux
Référence: CIS Rocky Linux 9 Benchmark v3.0.0 - 5.4.2.5

Vérifier cet hôte

Exécutez cette commande sur une machine que vous êtes autorisé à auditer. L'analyse est en lecture seule.

shell

tmaegis scan --target linux