mediumfilesystemverified ✓rollback-safe
Ensure system command files are owned by root
system-commands-owner · RHEL ≥ 8, UBUNTU ≥ 22 · 1 impl
Description
All files in /usr/bin, /usr/sbin, /usr/local/bin, and /usr/local/sbin must be owned by root to prevent unauthorized modification.
Rationale
System commands not owned by root could be modified by non-privileged users, enabling privilege escalation or system compromise.
Check → Remediate
Checkcommand
find /usr/bin /usr/sbin /usr/local/bin /usr/local/sbin ! -user root -type f 2>/dev/null | head -1
Remediatefile_permissions
- find_paths:
- /usr/bin, /usr/sbin, /usr/local/bin, /usr/local/sbin
- find_type:
- f
- find_args:
- ! -user root
- owner:
- root
Framework references
STIG
V-281037 / RHEL-10-400100V-257918 / RHEL-09-232190V-230258V-270702 / UBTU-24-300012V-260495 / UBTU-22-232050
NIST 800-53
AC-6CM-5
Live verification
rhel8:checkubuntu22:checkubuntu24:checkubuntu26:check
#file-permissions#system-commands#security