Ensure root PATH Integrity

보통레벨 2수동 검토cos

설명

The root user can execute any command on the system and could be fooled into executing programs unintentionally if the PATH is not set correctly. Including the current working directory (.) or other writable directory in root 's executable path makes it likely that an attacker can gain superuser access by forcing an administrator operating as root to execute a Trojan horse program.

점검 방법

감사 방식: 수동 검토

이 권장 사항은 자동으로 점검할 수 없습니다. --include-manual 옵션을 전달하면 스캔 결과에 이 지침과 함께 표시됩니다.

Run the following script and verify no results are returned: #!/bin/bash PATH="$(sudo -Hiu root env | grep '^PATH' | cut -d= -f2)" echo "$PATH" | grep -q "::" && echo "Empty directory in PATH (::)" echo "$PATH" | grep -q ":$" && echo "Trailing : in PATH" for dir in $(echo "$PATH" | tr ":" " "); do if [ -d "$dir" ]; then ls -ldH "$dir" | awk 'substr($1,6,1) != "-" {print $9, "is group writable"} substr($1,9,1) != "-" {print $9, "is world writable"} $3 != "root" {print $9, "is not owned by root"}' else base_dir=$(echo "$dir" | cut -d "/" -f2) # Ignore if directory is on read-only partition rw=$(findmnt -T "/$base_dir" | sed '1d' | grep -v "\sro,") if [ -n "$rw" ]; then echo "$dir is not a directory" fi fi done

조치 방법

조치 방식: 가이드 또는 인프라 패치

Correct or justify any items discovered in the Audit step.

속성

운영 체제: 모두
태그: container-optimized-oscos
참고 자료: CIS Google Container-Optimized OS Benchmark v1.2.0 - 6.2.6 Ensure root PATH Integrity