6.2.26 Ensure local interactive users' 'dot' files executable paths resolve to the users home directory.

Information

The operating system must be configured so that all local interactive user initialization (dot) files executable search paths contain only paths that resolve to the users home directory.

Rationale:

The executable search path (typically the PATH environment variable) contains a list of directories for the shell to search to find executables. If this path includes the current working directory (other than the user's home directory), executables in these directories may be executed instead of system commands. This variable is formatted as a colon-separated list of directories. If there is an empty entry, such as a leading or trailing colon or two consecutive colons, this is interpreted as the current working directory. If deviations from the default system search path for the local interactive user are required, they must be documented with the Information System Security Officer (ISSO).

NOTE: Nessus has provided the target output to assist in reviewing the benchmark to ensure target compliance.

Solution

Edit the local interactive user initialization files to change any PATH variable statements that reference directories other than their home directory.
Note: The example will be for the smithj user, which has a home directory of /home/smithj.
Utilizing the files listed in the Audit run this command to edit them and change the PATH variable statement.
Example: vim /home/smithj/.bash_profile
Update the PATH accordingly:

:PATH=$PATH:$HOME/.local/bin:$HOME/bin

If a local interactive user requires path variables to reference a directory owned by the application, it must be documented with the ISSO.

Notes:

This Benchmark recommendation maps to:

Red Hat Enterprise Linux 7 Security Technical Implementation Guide:

Version 2, Release: 3 Benchmark Date: 26 Apr 2019



Vul ID: V-72035

Rule ID: SV-86659r4_rule

STIG ID: RHEL-07-020720

Severity: CAT II

See Also

https://workbench.cisecurity.org/files/2688

Item Details

Category: CONFIGURATION MANAGEMENT

References: 800-53|CM-6b.

Plugin: Unix

Control ID: a34ee63bb279297c02220c2439252d625e867f0b3dff50ff3419ffb8dba7e31e