SV-38352r1: All shell files must be group-owned by root, bin, sys, or system. | HP-UX 11.23 Security Technical Implementation Guide

Loading benchmark…

Assessment Title

Rule Text

All shell files must be group-owned by root, bin, sys, or system.

Description

Discussion Text

If shell files are group-owned by users other than root or a system group, they could be modified by intruders or malicious users to perform unauthorized actions.

How this relates to the STIG checklist: STIG vs SCAP benchmark.

IA Controls

NIST SP 800-53

Not mappedCCI-000225

Additional Details

Responsibility

System Administrator

IA Controls

ECLP-1

References

DPMS Target HP-UX 11.23 DISA DPMS Target HP-UX 11.23 2170

SCC Automation Reference

The reconstructed evaluation script behind this rule's OVAL check(s) — every module a compound check combines, with this rule's own concrete values and DISA's SCC tool's real per-module mechanism curated from static teardown of SCC releases.

Assessment Script Powered by AISandbox-executed

A standalone Shell script to assess this control automatically. Review before running it in your environment.

Syntax-checked and actually executed in an isolated sandbox (not the real system this checks) — confirmed to run without errors.

#!/bin/sh
# This script implements the OVAL definition oval:mil.disa.fso.hpux11:def:129

if [ ! -d "/etc" ]; then echo "PASS"; exit 0; fi
for file in $(find /etc/shells -type f 2>/dev/null); do
    group=$(stat -c "%G" "$file")
    if [ "$group" = "root" ] || [ "$group" = "bin" ] || [ "$group" = "sys" ] || [ "$group" = "system" ]; then continue; else printf "%s\n" "FAIL"; exit 1; fi
done
echo "PASS"
exit 0

Remediation

Change the group owner of the shell to root, bin, sys, or other.


Procedure:
# chgrp root <shell>