SV-217175r1184447: All SUSE operating system local initialization files must have mode 0740 or less permissive. | SUSE Linux Enterprise Server 12 STIG SCAP Benchmark

Loading benchmark…

Assessment Title

Rule Text

All SUSE operating system local initialization files must have mode 0740 or less permissive.

Description

Discussion Text

Local initialization files are used to configure the user's shell environment upon logon. Malicious modification of these files could compromise accounts upon logon.

How this relates to the STIG checklist: STIG vs SCAP benchmark.

IA Controls

NIST SP 800-53

Not mappedCCI-000366SV-91911V-77215

References

DPMS Target SUSE Linux Enterprise Server 12 DISA DPMS Target SUSE Linux Enterprise Server 12 4033

Checks

DISA STIG (Manual Reference)

Verify that all SUSE operating system local initialization files have a mode of "0740" or less permissive.

Check the mode on all SUSE operating system local initialization files with the following command:

Note: The example will be for the user "dosuser", who has a home directory of "/home/dosuser".

# ls -al /home/dosuser/.* | more
-rwxr-xr-x  1 dosuser users   896 Mar 10  2011 .profile
-rwxr-xr-x  1 dosuser users   497 Jan  6  2007 .login
-rwxr-xr-x  1 dosuser users   886 Jan  6  2007 .something

If any local initialization files have a mode more permissive than "0740", this is a finding.

SCC Automation Reference

The reconstructed evaluation script behind this rule's OVAL check(s) — every module a compound check combines, with this rule's own concrete values and DISA's SCC tool's real per-module mechanism curated from static teardown of SCC releases.

Assessment Script Powered by AISandbox-executed

A standalone Shell script to assess this control automatically. Review before running it in your environment.

Syntax-checked and actually executed in an isolated sandbox (not the real system this checks) — confirmed to run without errors.

#!/bin/sh
# OVAL definition: oval:mil.disa.stig.sles12os:def:217175
export HOME=$(getent passwd "$1" | cut -d: -f6)
files=$(find "$HOME" -maxdepth 1 -type f -name '.*' 2>/dev/null)
if [ -z "$files" ]; then echo "PASS"; exit 0; fi
for file in $files; do
  perm=$(stat -c "%a" "$file")
  [ $perm -le 740 ] && continue
  echo "FAIL"
  exit 1
done
echo "PASS"
exit 0

Remediation

Set the mode of SUSE operating system local initialization files to "0740" with the following command:

Note: The example will be for the dosuser user, who has a home directory of "/home/dosuser".

# chmod 0740 /home/dosuser/.<INIT_FILE>