Ensure root path integrity

Trung bìnhCấp 1Tự độnglinux

Mô tả

The PATH variable for the root user determines the directories the shell searches for executables when root runs a command that is not given as an absolute path. Its integrity depends on the ownership, permissions, and composition of the directories it lists.

Cách kiểm tra

Phương pháp kiểm tra: Lệnh shell

shell

alt0() { o=$(bash -c '#!/usr/bin/env bash

{
   l_pmask="0022"
   l_root_path="$(su - root -c '"'"'printf "%s" "$PATH"'"'"')"
   grep -q  -- "::" <<< "$l_root_path" && echo " - root'"'"'s PATH contains an empty directory (::)"
   grep -Pq -- ":\h*$" <<< "$l_root_path" && echo " - root'"'"'s PATH ends with a trailing colon (:)"
   grep -Pq -- '"'"'(^\h*|:)\.(:|\h*$)'"'"' <<< "$l_root_path" && echo " - root'"'"'s PATH contains the current working directory (.)"
   IFS=":" read -ra a_path_loc <<< "$l_root_path"
   for l_path in "${a_path_loc[@]}"; do
      if [ -d "$l_path" ]; then
         while IFS=: read -r l_fmode l_fown; do
            [ "$l_fown" != "root" ] && echo " - Directory \"$l_path\" is owned by \"$l_fown\" (should be owned by root)"
            [ $(( l_fmode & l_pmask )) -gt 0 ] && echo " - Directory \"$l_path\" is mode \"$l_fmode\" (should be 0755 or more restrictive)"
         done <<< "$(stat -Lc '"'"'%#a:%U'"'"' "$l_path")"
      else
         echo " - \"$l_path\" is not an existing directory"
      fi
   done
}' 2>&1); [ -z "$o" ] || { echo "step1: $o" | head -c 300; return 1; }; }; if alt0; then echo compliant; fi

Đầu ra mong đợi: compliant

Cách khắc phục

Phương pháp khắc phục: Hướng dẫn hoặc bản vá hạ tầng

For each non-compliant item identified by the audit, correct root's PATH as follows. Edit the shell initialization file that sets root's PATH (for example /root/.bash_profile, /root/.bashrc, or the relevant file under /etc/profile.d/) and remove any current-working- directory (.) entry, any empty entry (::), and any trailing colon (:). For each directory in root's PATH that is not owned by root, run the following command to set its owner to root: # chown root <directory> For each directory in root's PATH that is writable by group or other, run the following command to remove those permissions so the mode is 0755 or more restrictive: # chmod 0755 <directory> For each PATH entry that does not …

Thuộc tính

Hệ điều hành: rhel-9
Thẻ: cis-convertedlinux
Tham chiếu: CIS Red Hat Enterprise Linux 9 Benchmark v3.0.0 - 5.4.2.5

Kiểm tra máy này

Chạy lệnh này trên máy bạn được phép kiểm tra. Lần quét chỉ ở chế độ đọc.

shell

tmaegis scan --target linux