The root account must not have world-writable directories in its executable search path.

From SOLARIS 10 SPARC SECURITY TECHNICAL IMPLEMENTATION GUIDE

Associated with IA controls: ECCD-2, ECCD-1

Associated with: CCI-000366

SV-37075r1_rule The root account must not have world-writable directories in its executable search path.

Vulnerability discussion

If the root search path contains a world-writable directory, malicious software could be placed in the path by intruders and/or malicious users and inadvertently run by root with all of root's privileges.

Check content

Check for world-writable permissions on all directories in the root user's executable search path. Procedure (on multiple lines): # echo $PATH | sed 's/ /\\ /g; s/:/ /g' | xargs ls -ld If any of the directories in the PATH variable are world-writable, this is a finding.

Fix text

For each world-writable path in root's executable search path, perform one of the following. 1. Remove the world-writable permission on the directory. Procedure: # chmod o-w 2. Remove the world-writable directory from the executable search path. Procedure: Identify and edit the initialization file referencing the world-writable directory and remove it from the PATH variable.

Pro Tips

Lavender hyperlinks in small type off to the right (of CSS class id, if you view the page source) point to globally unique URIs for each document and item. Copy the link location and paste anywhere you need to talk unambiguously about these things.

You can obtain data about documents and items in other formats. Simply provide an HTTP header Accept: text/turtle or Accept: application/rdf+xml.