SV-226543r603265: All system start-up files must be group-owned by root, sys, or bin. | Solaris 10 SPARC STIG SCAP Benchmark

Loading benchmark…

Assessment Title

Rule Text

All system start-up files must be group-owned by root, sys, or bin.

Description

Discussion Text

If system start-up files do not have a group owner of root or a system group, the files may be modified by malicious users or intruders.

How this relates to the STIG checklist: STIG vs SCAP benchmark.

IA Controls

NIST SP 800-53

Not mappedCCI-000366SV-27213V-4090

References

DPMS Target Solaris 10 SPARC DISA DPMS Target Solaris 10 SPARC 4060

Checks

DISA STIG (Manual Reference)

Check run control scripts' group ownership.

Procedure:
# ls -lL /etc/rc* /etc/init.d

If any run control script is not group-owned by root, sys, or bin, this is a finding.

SCC Automation Reference

The reconstructed evaluation script behind this rule's OVAL check(s) — every module a compound check combines, with this rule's own concrete values and DISA's SCC tool's real per-module mechanism curated from static teardown of SCC releases.

Assessment Script Powered by AISandbox-executed

A standalone Shell script to assess this control automatically. Review before running it in your environment.

Syntax-checked and actually executed in an isolated sandbox (not the real system this checks) — confirmed to run without errors.

#!/bin/sh
# OVAL Definition: oval:mil.disa.fso.solaris11:def:115
files=("rc0.d" "rc1.d" "rc2.d" "rc3.d" "rc4.d" "rc5.d" "rc6.d")
for file in "${files[@]}"; do
    if [ -d "$file" ]; then
        dir_contents=$(find "$file" -maxdepth 1 -type f)
        for item in $dir_contents; do
            group=$(stat -c "%G" "$item")
            if [ "$group" != "root" ] && [ "$group" != "sys" ] && [ "$group" != "bin" ]; then
                echo "FAIL"
                exit 1
            fi
        done
    fi
done
echo "PASS"
exit 0

Remediation

Change the group ownership of the run control script(s) with incorrect group ownership.

Procedure:
# chgrp root <run control script>