Ensure root path integrity

보통레벨 1자동linux

설명

The PATH variable for the root user determines the directories the shell searches for executables when root runs a command that is not given as an absolute path. Its integrity depends on the ownership, permissions, and composition of the directories it lists.

점검 방법

감사 방식: 셸 명령

shell

alt0() { o=$(bash -c '#!/usr/bin/env bash

{
   l_pmask="0022"
   l_root_path="$(su - root -c '"'"'printf "%s" "$PATH"'"'"')"
   grep -q  -- "::" <<< "$l_root_path" && echo " - root'"'"'s PATH contains an empty directory (::)"
   grep -Pq -- ":\h*$" <<< "$l_root_path" && echo " - root'"'"'s PATH ends with a trailing colon (:)"
   grep -Pq -- '"'"'(^\h*|:)\.(:|\h*$)'"'"' <<< "$l_root_path" && echo " - root'"'"'s PATH contains the current working directory (.)"
   IFS=":" read -ra a_path_loc <<< "$l_root_path"
   for l_path in "${a_path_loc[@]}"; do
      if [ -d "$l_path" ]; then
         while IFS=: read -r l_fmode l_fown; do
            [ "$l_fown" != "root" ] && echo " - Directory \"$l_path\" is owned by \"$l_fown\" (should be owned by root)"
            [ $(( l_fmode & l_pmask )) -gt 0 ] && echo " - Directory \"$l_path\" is mode \"$l_fmode\" (should be 0755 or more restrictive)"
         done <<< "$(stat -Lc '"'"'%#a:%U'"'"' "$l_path")"
      else
         echo " - \"$l_path\" is not an existing directory"
      fi
   done
}' 2>&1); [ -z "$o" ] || { echo "step1: $o" | head -c 300; return 1; }; }; if alt0; then echo compliant; fi

예상 출력: compliant

조치 방법

조치 방식: 가이드 또는 인프라 패치

For each non-compliant item identified by the audit, correct root's PATH as follows. Edit the shell initialization file that sets root's PATH (for example /root/.bash_profile, /root/.bashrc, or the relevant file under /etc/profile.d/) and remove any current-working- directory (.) entry, any empty entry (::), and any trailing colon (:). For each directory in root's PATH that is not owned by root, run the following command to set its owner to root: # chown root <directory> For each directory in root's PATH that is writable by group or other, run the following command to remove those permissions so the mode is 0755 or more restrictive: # chmod 0755 <directory> For each PATH entry that does not …

속성

운영 체제: rocky-9
태그: cis-convertedlinux
참고 자료: CIS Rocky Linux 9 Benchmark v3.0.0 - 5.4.2.5

이 호스트 점검하기

감사 권한이 있는 시스템에서 실행하세요. 스캔은 읽기 전용입니다.

shell

tmaegis scan --target linux