mediumfilesystemverified ✓rollback-safe
Ensure library files are group-owned by root
library-files-group · RHEL ≥ 8, UBUNTU ≥ 22 · 1 impl
Description
All shared library files in /lib, /lib64, /usr/lib, and /usr/lib64 must be group-owned by root.
Rationale
Library files group-owned by non-root accounts could be modified by group members. Root group ownership prevents this.
Check → Remediate
Checkcommand
find /lib /lib64 /usr/lib /usr/lib64 -name '*.so*' ! -group root -type f 2>/dev/null | head -1
Remediatefile_permissions
- find_paths:
- /lib, /lib64, /usr/lib, /usr/lib64
- find_name:
- *.so*
- find_type:
- f
- find_args:
- ! -group root
- group:
- root
Framework references
STIG
V-281040 / RHEL-10-400115V-257921 / RHEL-09-232205V-230262V-270699 / UBTU-24-300009V-260500 / UBTU-22-232075
NIST 800-53
AC-6CM-5
Live verification
rhel8:checkubuntu22:checkubuntu24:checkubuntu26:check
#file-permissions#library-files#security