UCF STIG Viewer Logo

All setuid executables on the system must be vendor-supplied.


Overview

Finding ID Version Rule ID IA Controls Severity
V-58439 AOSX-09-001145 SV-72869r1_rule Medium
Description
None of the executables that come preinstalled on Mac OS X have the setuid bit set, and administrators should never add the setuid bit to any executable that does not already have it set by the vendor. Executables with the setuid bit set allow anyone that executes them to be temporarily assigned the UID of the file owner. In practice, this almost always is the root account. While some vendors depend on this file attribute for proper operation, security problems can result if setuid is assigned to programs allowing reading and writing of files, or shell escapes, as this could lead to unprivileged users gaining privileged access to files and directories on the system.
STIG Date
Apple OS X 10.9 (Mavericks) Workstation Security Technical Implementation Guide 2017-01-05

Details

Check Text ( C-59265r1_chk )
If available, provide a list of setuids provided by a vendor. To list all of the files with the setuid bit set, run the following command to send all results to a file named suidfilelist:

sudo find / -perm -4000 -exec ls -ldb {} \; > suidfilelist

If any of the files listed are not documented as needing to have the setuid bit set by the vendor, this is a finding.
Fix Text (F-63753r1_fix)
Document all of the files with the setuid bit set.

Remove any undocumented files.