mediumfilesystemverified ✓rollback-safe

Ensure directories containing system commands are owned by root

system-command-dirs-owner · UBUNTU ≥ 22 · 1 impl

Description

The directories that contain system commands (/bin, /sbin, /usr/bin, /usr/sbin, /usr/local/bin, /usr/local/sbin) must be owned by root.

Rationale

If a command directory is owned by a non-root account, that account can add or replace executables run by other users. Root ownership prevents unauthorized modification of the command set.

Check → Remediate

Checkcommand

find /bin /sbin /usr/bin /usr/sbin /usr/local/bin /usr/local/sbin ! -user root -type d 2>/dev/null | head -1

Remediatefile_permissions

find_paths:: /bin, /sbin, /usr/bin, /usr/sbin, /usr/local/bin, /usr/local/sbin
find_type:: d
find_args:: ! -user root
owner:: root

Framework references

STIG

V-270825 / UBTU-24-901270V-260493 / UBTU-22-232040

NIST 800-53

AC-6CM-5

Live verification

ubuntu22:checkubuntu24:checkubuntu26:check

#file-permissions#system-commands#security