All setuid executables on the system must be vendor-supplied.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-58439	AOSX-09-001145	SV-72869r1_rule		Medium

Description
None of the executables that come preinstalled on Mac OS X have the setuid bit set, and administrators should never add the setuid bit to any executable that does not already have it set by the vendor. Executables with the setuid bit set allow anyone that executes them to be temporarily assigned the UID of the file owner. In practice, this almost always is the root account. While some vendors depend on this file attribute for proper operation, security problems can result if setuid is assigned to programs allowing reading and writing of files, or shell escapes, as this could lead to unprivileged users gaining privileged access to files and directories on the system.

Description

None of the executables that come preinstalled on Mac OS X have the setuid bit set, and administrators should never add the setuid bit to any executable that does not already have it set by the vendor. Executables with the setuid bit set allow anyone that executes them to be temporarily assigned the UID of the file owner. In practice, this almost always is the root account. While some vendors depend on this file attribute for proper operation, security problems can result if setuid is assigned to programs allowing reading and writing of files, or shell escapes, as this could lead to unprivileged users gaining privileged access to files and directories on the system.

STIG	Date
Apple OS X 10.9 (Mavericks) Workstation Security Technical Implementation Guide	2017-01-05

Details

Check Text ( C-59265r1_chk )
If available, provide a list of setuids provided by a vendor. To list all of the files with the setuid bit set, run the following command to send all results to a file named suidfilelist: sudo find / -perm -4000 -exec ls -ldb {} \; > suidfilelist If any of the files listed are not documented as needing to have the setuid bit set by the vendor, this is a finding.

Fix Text (F-63753r1_fix)
Document all of the files with the setuid bit set. Remove any undocumented files.