TMA-SOLARIS-9.8

Ensure root PATH Integrity

高级别 1自动化solaris

说明

The root user can execute any command on the system and could be tricked into executing programs if the PATH is not set correctly. Including the current working directory (.) or any other writable directory in root's executable path makes it likely that an attacker can gain superuser access by forcing an administrator operating as root to execute a malcode, such as a Trojan horse program. Audit: root's login PATH must not contain ::, a trailing :, '.', or group/other writable directories.

检查方式

审计方法: Shell 命令

shell

p=$(su - root -c 'echo $PATH' 2>/dev/null | tail -n 1); [ -n "$p" ] || exit 1; r=compliant; case "$p" in *::*) r="Empty Directory in PATH (::)";; *:) r="Trailing : in PATH";; esac; IFS=:; set -- $p; unset IFS; for d in "$@"; do [ "$d" = . ] && r="PATH contains ."; if [ -d "$d" ]; then s=$(ls -ld "$d/" | awk 'substr($1,6,1)!="-" {print "Group Write permission set on directory"} substr($1,9,1)!="-" {print "Other Write permission set on directory"}' | head -n 1); [ -z "$s" ] || r="$s $d"; fi; done; echo "$r"

预期输出: compliant

修复方式

修复方法: 操作指南或基础设施补丁

Correct or justify any items discovered in the Audit step.

属性

操作系统: 任意
标签: solarisaccounts
参考: CIS Oracle Solaris 11.4 Benchmark v1.1.0 - 9.8 Ensure root PATH Integrity

检查本机

请在您有权审计的机器上运行此命令。扫描为只读操作。

shell

tmaegis scan --target solaris