0046-libsbin-priv-File permissions modified under the /sbin directory
Rule ID
Category
Level
Compatible Versions
Description
- Monitors whether file permissions under the host directory
/sbin have been modified.
Scan Frequency
Rationale
- The
/sbin directory stores executable files of essential system commands. If permissions are changed, commands may fail to execute, affecting the system.
Risk Items
Audit Method
- Run the following command on the specified file. Here, the
ss file is used as an example. Verify that the Uid and Gid are both 0/root and the permissions are 755:
stat /usr/sbin/ss
Access: (0755/-rwxr-xr-x) Uid: ( 0/ root) Gid: ( 0/ root)
- If a permission change is detected for a file under the
/sbin directory, log in to the server as the root user, restore the correct permissions, and audit the change.
Impact
Default Value
References
CIS Controls