mediumaccess-controlunverified

Ensure executable search paths in user init files resolve to system or home

user-init-path-safe · RHEL ≥ 8 · 1 impl

Description

Executable search-path (PATH) statements in local interactive user initialization files must reference only the system default directories or the user's own home directory. A current-directory element, an empty element, or an absolute directory outside the standard system prefixes and the home directory is a finding.

Rationale

A PATH that includes the current directory, an empty element (equivalent to the current directory), or an attacker-writable directory lets a malicious binary be executed in place of a trusted command when the user runs it, enabling privilege escalation.

Check → Remediate

Checkcommand

fail=0
files=$(find /home -maxdepth 2 -type f -name '.*' 2>/dev/null)
for hf in $files; do
  # PATH assignments (PATH=... or export PATH=...), value only.
  vals=$(grep -iE '(^|[[:space:]])PATH=' "$hf" 2>/dev/null \
         | sed -E 's/.*[Pp][Aa][Tt][Hh]=//; s/["'"'"']//g')
  [ -n "$vals" ] || continue
  printf '%s\n' "$vals" | tr ':' '\n' | while IFS= read -r elem; do
    case "$elem" in
      ''|'.'|'./'*) echo "FAIL: $hf PATH has current-dir/empty element"; exit 3 ;;
      '$PATH'|'${PATH}'|'$HOME'*|'${HOME}'*|'~'*) : ;;   # safe references
      /usr/*|/bin*|/sbin*|/opt/*|/usr/local/*) : ;;      # system defaults
      /home/*) : ;;                                       # a home directory
      '$'*) : ;;                                          # other variable ref — defer to review
      /*) echo "FAIL: $hf PATH references non-standard dir '$elem'"; exit 3 ;;
    esac
  done || fail=1
done
if [ "$fail" -eq 0 ]; then
  echo "OK: user init PATH statements resolve to system defaults or home"
  exit 0
fi
exit 1

expected_exit:: 0

Remediatemanual

note:: Edit the offending user initialization file so PATH appends only the user's home directory and the system defaults, e.g.: PATH="$HOME/bin:$PATH" Remove any current-directory ('.' or empty) element or absolute path outside the standard system directories.

Framework references

STIG

V-281176 / RHEL-10-600170V-258050 / RHEL-09-411055V-230317 / RHEL-08-010690

NIST 800-53

CM-6

#path#user-accounts#initialization-files#hardening#stig