Title

All system command files must have mode 755 or less permissive. (Cat II impact)

Discussion

System binaries are executed by privileged users, as well as system services, and restrictive permissions are necessary to ensure execution of these programs cannot be co-opted.

Check Content

System executables are stored in the following directories by default: /bin /usr/bin /usr/local/bin /sbin /usr/sbin /usr/local/sbin All files in these directories should not be group-writable or world-writable. To find system executables that are group-writable or world-writable, run the following command for each directory [DIR] which contains system executables: $ find -L [DIR] -perm /022 -type f If any system executables are found to be group-writable or world-writable, this is a finding.

Fix Text

System executables are stored in the following directories by default: /bin /usr/bin /usr/local/bin /sbin /usr/sbin /usr/local/sbin If any file in these directories is found to be group-writable or world-writable, correct its permission with the following command: # chmod go-w [FILE]

Additional Identifiers

Rule ID: SV-217885r603264_rule

Vulnerability ID: V-217885

Group Title: SRG-OS-000259

Expert Comments

CCIs tied to check.

Controls tied to check. These are derived from the CCIs shown above.