Cis GCP Cos 6.2.6

6.2.6 Ensure root PATH Integrity (Automated)

Description

The root user can execute any command on the system and could be fooled into executing programs unintentionally if the PATH is not set correctly.

Rationale

Including the current working directory (.) or other writable directory in root's executable path makes it likely that an attacker can gain superuser access by forcing an administrator operating as root to execute a Trojan horse program.

Audit Procedure

Run the following script and verify no results are returned:

#!/bin/bash

PATH="$(sudo -Hiu root env | grep '^PATH' | cut -d= -f2)"
echo "$PATH" | grep -q "::" && echo "Empty directory in PATH (::)"
echo "$PATH" | grep -q ":$" && echo "Trailing : in PATH"
for dir in $(echo "$PATH" | tr ":" " "); do
    if [ -d "$dir" ]; then
        ls -ldH "$dir" | awk 'substr($1,6,1) != "-" {print $9, "is group writable"}
            substr($1,9,1) != "-" {print $9, "is world writable"}
            $3 != "root" {print $9, "is not owned by root"}'
    else
        base_dir=$(echo "$dir" | cut -d "/" -f2)
        # Ignore if directory is on read-only partition
        rw=$(findmnt -T "/$base_dir" | sed '1d' | grep -v "\sro,")
        if [ -n "$rw" ]; then
            echo "$dir is not a directory"
        fi
    fi
done

Expected Result

No results should be returned.

Remediation

Correct or justify any items discovered in the Audit step.

CIS Controls

Profile

• Level 2 - Server