All setuid executables on the system must be vendor-supplied.

From Apple OS X 10.11 Security Technical Implementation Guide

Associated with: CCI-000366

SV-82215r1_rule All setuid executables on the system must be vendor-supplied.

Vulnerability discussion

Very few of the executables that come preinstalled on the OS X have the setuid bit set, and administrators should never add the setuid bit to any executable that does not already have it set by the vendor. Executables with the setuid bit set allow anyone that executes them to be temporarily assigned the UID of the file owner. In practice, this almost always is the root account. While some vendors depend on this file attribute for proper operation, security problems can result if setuid is assigned to programs allowing reading and writing of files, or shell escapes, as this could lead to unprivileged users gaining privileged access to files and directories on the system.

Check content

If available, provide a list of setuids provided by a vendor. To list all of the files with the "setuid" bit set, run the following command to send all results to a file named "suidfilelist": /usr/bin/sudo find / -perm -4000 -exec /bin/ls -ldb {} \; > suidfilelist If any of the files listed are not documented as needing to have the "setuid" bit set by the vendor, this is a finding.

Fix text

Document all of the files with the "setuid" bit set. Remove any undocumented files.

Pro Tips

Lavender hyperlinks in small type off to the right (of CSS class id, if you view the page source) point to globally unique URIs for each document and item. Copy the link location and paste anywhere you need to talk unambiguously about these things.

You can obtain data about documents and items in other formats. Simply provide an HTTP header Accept: text/turtle or Accept: application/rdf+xml.