Skip to content
ATO Pathways
  Log In

Verify that system commands are protected from unauthorized access

An XCCDF Rule

Description

System commands are stored in the following directories by default: 

/bin
/sbin
/usr/bin
/usr/sbin
/usr/local/bin
/usr/local/sbin
All files in these directories should not be group-writable or world-writable. If any file FILE in these directories is found to be group-writable or world-writable, correct its permission with the following command: 
$ sudo chmod 755 FILE

Rationale

System binaries are executed by privileged users, as well as system services, and restrictive permissions are necessary to ensure execution of these programs cannot be co-opted.

ID
xccdf_org.ssgproject.content_rule_file_permissions_system_commands_dirs
Severity
Medium
References
Updated



Remediation - Ansible

- name: Retrieve the system command files and protect them from unautorized access
  command: find -L {{ item }} -perm /022 -type f -exec chmod go-w '{}' \;
  with_items:
  - /bin
  - /sbin
  - /usr/bin

Remediation - Shell Script


DIRS="/bin /sbin /usr/bin usr/sbin /usr/local/bin /usr/local/sbin"
for dirPath in $DIRS; do
	find -L "$dirPath" -perm /022 -type f -exec chmod go-w '{}' \;
done