Ensure root PATH Integrity

СреднийУровень 2Ручная проверкаcos

Описание

The root user can execute any command on the system and could be fooled into executing programs unintentionally if the PATH is not set correctly. Including the current working directory (.) or other writable directory in root 's executable path makes it likely that an attacker can gain superuser access by forcing an administrator operating as root to execute a Trojan horse program.

Как проверяется

Метод проверки: Ручная проверка

Эту рекомендацию нельзя проверить автоматически. Сканирование выводит её вместе с этими инструкциями при указании флага --include-manual.

Run the following script and verify no results are returned: #!/bin/bash PATH="$(sudo -Hiu root env | grep '^PATH' | cut -d= -f2)" echo "$PATH" | grep -q "::" && echo "Empty directory in PATH (::)" echo "$PATH" | grep -q ":$" && echo "Trailing : in PATH" for dir in $(echo "$PATH" | tr ":" " "); do if [ -d "$dir" ]; then ls -ldH "$dir" | awk 'substr($1,6,1) != "-" {print $9, "is group writable"} substr($1,9,1) != "-" {print $9, "is world writable"} $3 != "root" {print $9, "is not owned by root"}' else base_dir=$(echo "$dir" | cut -d "/" -f2) # Ignore if directory is on read-only partition rw=$(findmnt -T "/$base_dir" | sed '1d' | grep -v "\sro,") if [ -n "$rw" ]; then echo "$dir is not a directory" fi fi done

Как исправляется

Метод исправления: Рекомендация или патч инфраструктуры

Correct or justify any items discovered in the Audit step.

Свойства

Операционные системы: Любая
Теги: container-optimized-oscos
Источник: CIS Google Container-Optimized OS Benchmark v1.2.0 - 6.2.6 Ensure root PATH Integrity