Skip to content
ATO Pathways
  Log In

Verify that Shared Library Directories Have Root Ownership

An XCCDF Rule

Description

System-wide shared library files, which are linked to executables during process load time or run time, are stored in the following directories by default: 

/lib
/lib64
/usr/lib
/usr/lib64
Kernel modules, which can be added to the kernel during runtime, are also stored in /lib/modules. All files in these directories should be owned by the root user. If the directories, is found to be owned by a user other than root correct its ownership with the following command: 
$ sudo chown root DIR

Rationale

Files from shared library directories are loaded into the address space of processes (including privileged ones) or of the kernel itself at runtime. Proper ownership of library directories is necessary to protect the integrity of the system.

ID
xccdf_org.ssgproject.content_rule_dir_ownership_library_dirs
Severity
Medium
References
Updated



Remediation - Ansible

- name: Ensure owner on directory /lib/ recursively
  file:
    path: /lib/
    state: directory
    recurse: true
    owner: '0'

Remediation - Shell Script

find -H /lib/  -type d -exec chown 0 {} \;
find -H /lib64/  -type d -exec chown 0 {} \;
find -H /usr/lib/  -type d -exec chown 0 {} \;
find -H /usr/lib64/  -type d -exec chown 0 {} \;