mediumfilesystemverified ✓rollback-safe
Ensure library directories have mode 755 or less
library-dirs-mode · RHEL ≥ 8 · 1 impl
Description
All shared library directories in /lib, /lib64, /usr/lib, and /usr/lib64 must have mode 755 or less permissive.
Rationale
World-writable library directories could allow insertion of malicious libraries that are loaded by system applications. Restrictive permissions prevent this.
Check → Remediate
Checkcommand
find /lib /lib64 /usr/lib /usr/lib64 -perm /022 -type d 2>/dev/null | head -1
Remediatefile_permissions
- find_paths:
- /lib, /lib64, /usr/lib, /usr/lib64
- find_type:
- d
- find_args:
- -perm /022
- mode:
- go-w
Framework references
STIG
V-281059 / RHEL-10-400210V-257883 / RHEL-09-232015V-251707
NIST 800-53
AC-6CM-5
Live verification
rhel8:check
#file-permissions#library-files#security