mediumfilesystemverified ✓rollback-safe

Ensure directories containing system commands have mode 0755 or less

system-command-dirs-mode · UBUNTU ≥ 22 · 1 impl

Description

The directories that contain system commands (/bin, /sbin, /usr/bin, /usr/sbin, /usr/local/bin, /usr/local/sbin) must have mode 0755 or less permissive.

Rationale

A world-writable command directory lets an unprivileged user add or replace executables that other users — including root — run. Restrictive directory permissions prevent this.

Check → Remediate

Checkcommand

find /bin /sbin /usr/bin /usr/sbin /usr/local/bin /usr/local/sbin -perm /022 -type d 2>/dev/null | head -1

Remediatefile_permissions

find_paths:: /bin, /sbin, /usr/bin, /usr/sbin, /usr/local/bin, /usr/local/sbin
find_type:: d
find_args:: -perm /022
mode:: go-w

Framework references

STIG

V-270824 / UBTU-24-901260V-260485 / UBTU-22-232010

NIST 800-53

AC-6CM-5

Live verification

ubuntu22:checkubuntu24:checkubuntu26:check

#file-permissions#system-commands#security