Skip to content
ATO Pathways
  Log In

Verify that Shared Library Files Have Root Ownership

An XCCDF Rule

Description

System-wide shared library files, which are linked to executables during process load time or run time, are stored in the following directories by default: 

/lib
/lib64
/usr/lib
/usr/lib64
Kernel modules, which can be added to the kernel during runtime, are also stored in /lib/modules. All files in these directories should be owned by the root user. If the directory, or any file in these directories, is found to be owned by a user other than root correct its ownership with the following command: 
$ sudo chown root FILE

Rationale

Files from shared library directories are loaded into the address space of processes (including privileged ones) or of the kernel itself at runtime. Proper ownership is necessary to protect the integrity of the system.

ID
xccdf_org.ssgproject.content_rule_file_ownership_library_dirs
Severity
Medium
References
Updated



Remediation - Shell Script


find /lib/  -type f ! -uid 0 -regex '^.*$' -exec chown 0 {} \;

find /lib64/  -type f ! -uid 0 -regex '^.*$' -exec chown 0 {} \;

find /usr/lib/  -type f ! -uid 0 -regex '^.*$' -exec chown 0 {} \;

Remediation - Ansible

- name: Find /lib/ file(s) matching ^.*$ recursively
  command: find -H /lib/  -type f ! -uid 0 -regex "^.*$"
  register: files_found
  changed_when: false
  failed_when: false
  check_mode: false