Detections
Analytics

2.4.3.2 Ensure access to systemd service unit files is configured

Information

systemd service unit files contain information about the service and the process it supervises defines how and when the service is started, stopped, and managed by systemd, which is the init system and service manager.

Improperly secured service unit files can allow authorized code execution or privilege execution.

Solution

Run the following commands to set access to mode 0644 or more restrictive, owned by the root user, and owned by the root group:

# chmod u-x,go-wx
# chown root:root </path/to/systemd/.service>

Impact:

Service execution failures due to restrictive permissions and reduced functionality from least-privilege enforcement

See Also

https://workbench.cisecurity.org/benchmarks/26236

Item Details

Category: ACCESS CONTROL, CONFIGURATION MANAGEMENT, MEDIA PROTECTION

References: 800-53|AC-3, 800-53|AC-5, 800-53|AC-6, 800-53|CM-6, 800-53|MP-2, CSCv7|14.6

Plugin: Unix

Control ID: 72235379e7e73e2fd8996042b34b205720e01273a410dbdf2d7ba1a28c3688cf