Ensure group root is the only GID 0 group

中级别 1自动化linux

说明

The groupmod command can be used to specify which group the root group belongs to. This affects permissions of files that are group owned by the root group.

检查方式

审计方法: Shell 命令

shell

alt0() { command -v awk >/dev/null 2>&1 || { echo "step1: awk not installed"; return 1; }; o=$(bash -c 'awk -F: '"'"'$3=="0"{print $1":"$3}'"'"' /etc/group' 2>&1); printf '%s\n' "$o" | tr -s ' \t' '  ' | sed 's/^ //;s/ $//' | grep -Fxq -- root:0 || { echo step1: missing root:0; return 1; }; }; if alt0; then echo compliant; fi

预期输出: compliant

修复方式

修复方法: 操作指南或基础设施补丁

Run the following command to set the root group's GID to 0: # groupmod -g 0 root Remove any groups other than the root group with GID 0 or assign them a new GID if appropriate.

属性

操作系统: rocky-8
标签: cis-convertedlinux
参考: CIS Rocky Linux 8 Benchmark v3.0.0 - 5.4.2.3

检查本机

请在您有权审计的机器上运行此命令。扫描为只读操作。

shell

tmaegis scan --target linux