Container-Optimized OS
TMA-COS-6.2.6
Ensure root PATH Integrity
Mô tả
The root user can execute any command on the system and could be fooled into executing programs unintentionally if the PATH is not set correctly. Including the current working directory (.) or other writable directory in root 's executable path makes it likely that an attacker can gain superuser access by forcing an administrator operating as root to execute a Trojan horse program.
Cách kiểm tra
Phương pháp kiểm tra: Xem xét thủ công
Run the following script and verify no results are returned: #!/bin/bash PATH="$(sudo -Hiu root env | grep '^PATH' | cut -d= -f2)" echo "$PATH" | grep -q "::" && echo "Empty directory in PATH (::)" echo "$PATH" | grep -q ":$" && echo "Trailing : in PATH" for dir in $(echo "$PATH" | tr ":" " "); do if [ -d "$dir" ]; then ls -ldH "$dir" | awk 'substr($1,6,1) != "-" {print $9, "is group writable"} substr($1,9,1) != "-" {print $9, "is world writable"} $3 != "root" {print $9, "is not owned by root"}' else base_dir=$(echo "$dir" | cut -d "/" -f2) # Ignore if directory is on read-only partition rw=$(findmnt -T "/$base_dir" | sed '1d' | grep -v "\sro,") if [ -n "$rw" ]; then echo "$dir is not a directory" fi fi done
Cách khắc phục
Phương pháp khắc phục: Hướng dẫn hoặc bản vá hạ tầng
Correct or justify any items discovered in the Audit step.
Thuộc tính
- Hệ điều hành
- Bất kỳ
- Thẻ
- container-optimized-oscos
- Tham chiếu
- CIS Google Container-Optimized OS Benchmark v1.2.0 - 6.2.6 Ensure root PATH Integrity