0049-libusrbin-priv-/usr/bin Directory File Permissions Modified
Rule ID
Category
Level
Compatible Versions
Description
- Monitor whether the file permissions in the /usr/bin directory on the host have been modified.
Scan Frequency
Theoretical Basis
- The /usr/bin directory contains executable files for essential system commands. If permissions change, it may prevent commands from executing and impact the system.
Risk Items
Audit Method
- Run the following command on the specified file to verify that Uid and Gid are both 0/root, and the permissions are 755. For example, using the users file:
stat /usr/bin/users
Access: (0755/-rwxr-xr-x) Uid: ( 0/ root) Gid: ( 0/ root)
- If a file permission in the /usr/bin directory has been changed, log in as the root user and restore the permissions. Audit this change.
Impact
Default Value
References
CIS Controls