Title

The root shell must be located in the / file system. (Cat III impact)

Discussion

To ensure the root shell is available in repair and administrative modes, the root shell must be located in the / file system.

Check Content

Perform the following to determine if /usr is partitioned. # grep /usr /etc/vfstab If /usr is partitioned, check the location of root's default shell. # awk -F: '$1 == "root" {print $7}' /etc/passwd If the root shell is found to be on a partitioned /usr filesystem or is in a directory symlinked to a partitioned /usr filesystem, even if the actual root shell is a symlink back to the root filesystem, this is a finding.

Fix Text

Change the root account's shell to one present on the / filesystem. Example: # usermod -s /sbin/sh root

Additional Identifiers

Rule ID: SV-226481r603265_rule

Vulnerability ID: V-226481

Group Title: SRG-OS-000480

Expert Comments

CCIs tied to check.

Controls tied to check. These are derived from the CCIs shown above.