Detections
Analytics

5.4.2.5 Ensure root path integrity

Information

The PATH variable for the root user determines the directories the shell searches for executables when root runs a command that is not given as an absolute path. Its integrity depends on the ownership, permissions, and composition of the directories it lists.

Including the current working directory (.) or other writable directory in root 's executable path makes it likely that an attacker can gain superuser access by forcing an administrator operating as root to execute a Trojan horse program.

Solution

For each non-compliant item identified by the audit, correct root's PATH as follows.

Edit the shell initialization file that sets root's PATH (for example /root/.bash_profile, /root/.bashrc, or the relevant file under /etc/profile.d/) and remove any current-working-directory (.) entry, any empty entry (::), and any trailing colon (:).

For each directory in root's PATH that is not owned by root, run the following command to set its owner to root:

# chown root <directory>

For each directory in root's PATH that is writable by group or other, run the following command to remove those permissions so the mode is 0755 or more restrictive:

# chmod 0755 <directory>

For each PATH entry that does not exist on the system, either remove it from root's PATH or run the following command to create it with root ownership and an appropriate mode:

# mkdir -p <directory> && chown root <directory> && chmod 0755 <directory>

After making these changes, re-run the audit to confirm root's PATH contains only existing, root-owned directories that are not writable by group or other, with no empty, trailing, or . entries.

See Also

https://workbench.cisecurity.org/benchmarks/27893

Item Details

Category: CONFIGURATION MANAGEMENT, IDENTIFICATION AND AUTHENTICATION

References: 800-53|CM-1, 800-53|CM-2, 800-53|CM-6, 800-53|CM-7, 800-53|IA-5

Plugin: Unix

Control ID: af2fa98e7d95c96a840ee0fafdb40e4236a60113251ee9ff9b86033c5da1549b