cis-ubuntu2004-v300-5-4-2-5

name	cis-ubuntu2004-v300-5-4-2-5
description	Ensure root path integrity
category	cis-iam
version	3.0.0
author	cyberstrike-official
tags	["cis","ubuntu","linux","ubuntu-20.04","users","authentication"]
cis_id	5.4.2.5
cis_benchmark	CIS Ubuntu Linux 20.04 LTS Benchmark v3.0.0
tech_stack	["ubuntu","linux"]
cwe_ids	[]
chains_with	[]
prerequisites	[]
severity_boost	{}

5.4.2.5 Ensure root path integrity (Automated)

Profile

• Level 1 - Server
• Level 1 - Workstation

Description

The root user can execute any command on the system and could be fooled into executing programs unintentionally if the PATH is not set correctly.

Rationale

Including the current working directory (.) or other writable directory in root's executable path makes it likely that an attacker can gain superuser access by forcing an administrator operating as root to execute a Trojan horse program.

Audit Procedure

Command Line

Run the following script to verify root's path does not include:

• Locations that are not directories
• An empty directory (::)
• A trailing (:)
• Current working directory (.)
• Non root owned directories
• Directories that less restrictive than mode 0755

#!/usr/bin/env bash

{
  l_output2=""
  l_pmask="0022"
  l_maxperm="$( printf '%o' $(( 0777 & ~$l_pmask )) )"
  l_root_path="$(sudo -Hiu root env | grep '^PATH' | cut -d= -f2)"
  unset a_path_loc && IFS=":" read -ra a_path_loc <<< "$l_root_path"
  grep -q "::" <<< "$l_root_path" && l_output2="$l_output2\n - root's path contains a empty directory (::)"
  grep -Pq ":\h*$" <<< "$l_root_path" && l_output2="$l_output2\n - root's path contains a trailing (:)"
  grep -Pq '(\h+|:)\.(:|\h*$)' <<< "$l_root_path" && l_output2=
    -r l_path; 
     [ -d  ]; 
        -r l_fmode l_fown; 
        [  !=  ] && l_output2=
        [ $((  &  )) -gt 0 ] && l_output2=
         <<< 
    
      l_output2=
    
   <<< 
   [ -z  ]; 
     -e 
  
     -e 
  
}