Detections
Analytics

GEN001760 - All global initialization files must be group-owned by root, sys, bin, other, system, or the system default - '/etc/bashrc'

Information

Global initialization files are used to configure the user's shell environment upon login. Malicious modification of these files could compromise accounts upon logon. Failure to give ownership of sensitive files or utilities to root or bin provides the designated owner and unauthorized users with the potential to access sensitive information or change the system configuration which could weaken the system's security posture.

Solution

Change the group ownership of the global initialization file(s) with incorrect group ownership.

Procedure:
# chgrp root <global initialization file>
or:
# ls -lL /etc/bashrc /etc/csh.cshrc /etc/csh.login /etc/csh.logout /etc/environment /etc/ksh.kshrc /etc/profile /etc/suid_profile /etc/profile.d/* 2>null|sed 's/^[^/]*//'|xargs stat -L -c %G:%n|egrep -v '^(root|sys|bin|other):'|cut -d: -f2|xargs chgrp root
will set the group of all files not currently owned by an approved group to root.

See Also

https://dl.dod.cyber.mil/wp-content/uploads/stigs/zip/U_Oracle_Linux_5_V2R1_STIG.zip

Item Details

Category: ACCESS CONTROL, CONFIGURATION MANAGEMENT

References: 800-53|AC-6, 800-53|CM-5(6), CAT|II, CCI|CCI-000225, CCI|CCI-001499, Rule-ID|SV-218328r603259_rule, STIG-ID|GEN001760, STIG-Legacy|SV-63871, STIG-Legacy|V-11983, Vuln-ID|V-218328

Plugin: Unix

Control ID: 4d547eb023580ce3041f96736f60b554a3fe2d1ea43f59b107ae11e9c5803003