mediumfilesystemverified ✓rollback-safe
Ensure library files have mode 755 or less
library-files-mode · RHEL ≥ 8, UBUNTU ≥ 22 · 1 impl
Description
All shared library files in /lib, /lib64, /usr/lib, and /usr/lib64 must have mode 755 or less permissive.
Rationale
World-writable library files could be replaced with malicious versions that are loaded by any application that uses them. Restrictive permissions prevent this.
Check → Remediate
Checkcommand
find /lib /lib64 /usr/lib /usr/lib64 -name '*.so*' -perm /022 -type f 2>/dev/null | head -1
Remediatefile_permissions
- find_paths:
- /lib, /lib64, /usr/lib, /usr/lib64
- find_name:
- *.so*
- find_type:
- f
- find_args:
- -perm /022
- mode:
- go-w
Framework references
STIG
V-281060 / RHEL-10-400215V-257884 / RHEL-09-232020V-230260V-270696 / UBTU-24-300006V-260487 / UBTU-22-232020
NIST 800-53
AC-6CM-5
Live verification
rhel8:checkubuntu22:checkubuntu24:checkubuntu26:check
#file-permissions#library-files#security