Rule ID
SV-45102r1_rule
Version
V1R12
CCIs
Global initialization files are used to configure the user's shell environment upon login. Malicious modification of these files could compromise accounts upon logon.
Check global initialization files for extended ACLs: # ls -l /etc/bash.bashrc /etc/csh.cshrc /etc/csh.login /etc/environment /etc/ksh.kshrc /etc/profile /etc/profile.d/* /etc/zshrc 2>/dev/null|grep "\+ " If the permissions include a '+', the file has an extended ACL. If the file has an extended ACL and it has not been documented with the IAO, this is a finding.
Remove the extended ACL from the file.
# ls -l /etc/bash.bashrc /etc/csh.cshrc /etc/csh.login /etc/environment /etc/ksh.kshrc /etc/profile /etc/profile.d/* /etc/zshrc 2>/dev/null|grep "\+ "| awk '{ print $8}' xargs setfacl --remove-all