Skip to content
ATO Pathways
  Log In

Verify that Shared Library Directories Have Root Group Ownership

An XCCDF Rule

Description

System-wide shared library files, which are linked to executables during process load time or run time, are stored in the following directories by default: 

/lib
/lib64
/usr/lib
/usr/lib64
Kernel modules, which can be added to the kernel during runtime, are also stored in /lib/modules. All files in these directories should be group-owned by the root user. If the directories, is found to be owned by a user other than root correct its ownership with the following command: 
$ sudo chgrp root DIR

Rationale

Files from shared library directories are loaded into the address space of processes (including privileged ones) or of the kernel itself at runtime. Proper ownership of library directories is necessary to protect the integrity of the system.

ID
xccdf_org.ssgproject.content_rule_dir_group_ownership_library_dirs
Severity
Medium
References
Updated



Remediation - Ansible

- name: Ensure group owner on /lib/ recursively
  file:
    path: /lib/
    state: directory
    recurse: true
    group: '0'

Remediation - Shell Script

find -H /lib/  -type d -exec chgrp 0 {} \;
find -H /lib64/  -type d -exec chgrp 0 {} \;
find -H /usr/lib/  -type d -exec chgrp 0 {} \;
find -H /usr/lib64/  -type d -exec chgrp 0 {} \;