mediumfilesystemverified ✓rollback-safe

Ensure directories containing system commands are group-owned by root

system-command-dirs-group · UBUNTU ≥ 22 · 1 impl

Description

The directories that contain system commands (/bin, /sbin, /usr/bin, /usr/sbin, /usr/local/bin, /usr/local/sbin) must be group-owned by root.

Rationale

If a command directory is group-owned by a non-privileged group, members of that group can add or replace executables run by other users. Root group ownership prevents unauthorized modification of the command set.

Check → Remediate

Checkcommand

find /bin /sbin /usr/bin /usr/sbin /usr/local/bin /usr/local/sbin ! -group root -type d 2>/dev/null | head -1

Remediatefile_permissions

find_paths:: /bin, /sbin, /usr/bin, /usr/sbin, /usr/local/bin, /usr/local/sbin
find_type:: d
find_args:: ! -group root
group:: root

Framework references

STIG

V-270826 / UBTU-24-901280V-260494 / UBTU-22-232045

NIST 800-53

AC-6CM-5

Live verification

ubuntu22:checkubuntu24:checkubuntu26:check

#file-permissions#system-commands#security