Skip to content
ATO Pathways
  Log In

Verify that System Executable Directories Have Restrictive Permissions

An XCCDF Rule

Description

System executables are stored in the following directories by default: 

/bin
/sbin
/usr/bin
/usr/sbin
/usr/local/bin
/usr/local/sbin
These directories should not be group-writable or world-writable. If any directory DIR in these directories is found to be group-writable or world-writable, correct its permission with the following command: 
$ sudo chmod go-w DIR

Rationale

System binaries are executed by privileged users, as well as system services, and restrictive permissions are necessary to ensure execution of these programs cannot be co-opted.

ID
xccdf_org.ssgproject.content_rule_dir_permissions_binary_dirs
Severity
Medium
References
Updated



Remediation - Shell Script






find -H /bin/  -perm /u+s,g+ws,o+wt -type d -exec chmod u-s,g-ws,o-wt {} \;

Remediation - Ansible

- name: Find /bin/ file(s) recursively
  command: 'find -H /bin/  -perm /u+s,g+ws,o+wt  -type d '
  register: files_found
  changed_when: false
  failed_when: false
  check_mode: false