Detections
Analytics

1.346 OL09-00-002520

Information

OL 9 library directories must be group-owned by root or a system account.

GROUP ID: V-271786
RULE ID: SV-271786r1092070

If OL 9 allowed any user to make changes to software libraries, then those changes might be implemented without undergoing the appropriate testing and approvals that are part of a robust change management process.

This requirement applies to OL 9 with software libraries that are accessible and configurable, as in the case of interpreted languages. Software libraries also include privileged programs that execute with escalated privileges.

Solution

Configure the system-wide shared library directories (/lib, /lib64, /usr/lib and /usr/lib64) to be protected from unauthorized access.

Run the following command, replacing "[DIRECTORY]" with any library directory not group-owned by "root".

$ sudo chgrp root [DIRECTORY]

See Also

https://workbench.cisecurity.org/benchmarks/27024

Item Details

Category: CONFIGURATION MANAGEMENT

References: 800-53|CM-5(6), CCI|CCI-001499, Rule-ID|SV-271786r1092070_rule, STIG-ID|OL09-00-002520, Vuln-ID|V-271786

Plugin: Unix

Control ID: fd7f1c804acee5d8190743d28d2cfc77a117aa0f3238383b74e05545ccc8cd62