Detections
Analytics

1.349 OL09-00-002523

Information

OL 9 library files must be group owned by root or a system account.

GROUP ID: V-271789
RULE ID: SV-271789r1134863

If OL 9 allowed any user to make changes to software libraries, then those changes might be implemented without undergoing the appropriate testing and approvals that are part of a robust change management process.

This requirement applies to OL 9 with software libraries that are accessible and configurable, as in the case of interpreted languages. Software libraries also include privileged programs that execute with escalated privileges.

Solution

Configure the OL 9 systemwide shared library files contained in the directories "/lib", "/lib64", "/usr/lib", and "/usr/lib64" to be group owned by root with the following command:

$ sudo find /lib /lib64 /usr/lib /usr/lib64 -type f -name '*.so*' ! -group root -exec chown :root {} +

See Also

https://workbench.cisecurity.org/benchmarks/27024

Item Details

Category: CONFIGURATION MANAGEMENT

References: 800-53|CM-5(6), CCI|CCI-001499, Rule-ID|SV-271789r1134863_rule, STIG-ID|OL09-00-002523, Vuln-ID|V-271789

Plugin: Unix

Control ID: bc965b2ce01580a6629e6ba6dd2980bd222abfa41ceea97cb189e33b462a15ec