mediumfilesystemunverified

Ensure local initialization files are not world-writable

user-init-no-world-writable · RHEL ≥ 10 · 1 impl

Description

Local interactive user initialization files (the dotfiles under home directories, e.g. .bashrc, .bash_profile) must not be world-writable, so that they cannot be modified by other users to execute code as the file's owner.

Rationale

A world-writable initialization file can be edited by any user to insert commands that run with the privileges of the account whose shell sources it — a straightforward local privilege-escalation path.

Check → Remediate

Checkcommand

hits=$(find /home -type f -name '.[^.]*' -perm -0002 2>/dev/null)
if [ -n "$hits" ]; then
  echo "FAIL: world-writable local initialization file(s) found:"
  printf '%s\n' "$hits" | sed 's/^/  /'
  exit 1
fi
echo "OK: no world-writable local initialization files"
exit 0

expected_exit:: 0

Remediatecommand_exec

find /home -type f -name '.[^.]*' -perm -0002 -exec chmod o-w {} + 2>/dev/null || true

Framework references

STIG

V-281095 / RHEL-10-400500

NIST 800-53

CM-6

#filesystem#init-files#world-writable#permissions#stig