mediumfilesystemverified ✓rollback-safe
Ensure library files are owned by root
library-files-owner · RHEL ≥ 8, UBUNTU ≥ 22 · 1 impl
Description
All shared library files in /lib, /lib64, /usr/lib, and /usr/lib64 must be owned by root.
Rationale
Library files not owned by root could be modified by non-privileged users to inject malicious code into any application that loads those libraries.
Check → Remediate
Checkcommand
find /lib /lib64 /usr/lib /usr/lib64 -name '*.so*' ! -user root -type f 2>/dev/null | head -1
Remediatefile_permissions
- find_paths:
- /lib, /lib64, /usr/lib, /usr/lib64
- find_name:
- *.so*
- find_type:
- f
- find_args:
- ! -user root
- owner:
- root
Framework references
STIG
V-281039 / RHEL-10-400110V-257920 / RHEL-09-232200V-230261V-270697 / UBTU-24-300007V-260499 / UBTU-22-232070
NIST 800-53
AC-6CM-5
Live verification
rhel8:checkubuntu22:checkubuntu24:checkubuntu26:check
#file-permissions#library-files#security