System start-up files must only execute programs owned by a privileged UID or an application.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-4091	GEN001700	SV-37270r1_rule	DCSL-1	Medium

Description
System start-up files executing programs owned by other than root (or another privileged user) or an application indicating the system may have been compromised.

STIG	Date
Red Hat Enterprise Linux 5 Security Technical Implementation Guide	2015-03-12

Details

Check Text ( C-35962r1_chk )
Determine the programs executed by system start-up files. Determine the ownership of the executed programs. # cat /etc/rc/ /etc/init.d/* \| more # ls -l Alternatively: # for FILE in `egrep -r "/" /etc/rc.* /etc/init.d\|awk '/^.[^\/][0-9A-Za-z_\/]/{print $2}'\|egrep "^/"\|sort\|uniq`;do if [ -e $FILE ]; then stat -L -c '%U:%n' $FILE;fi;done This provides a list of files referenced by initialization scripts and their associated UIDs. If any file is run by an initialization file and is not owned by root, sys, bin, or in rare cases, an application account, this is a finding.

Check Text ( C-35962r1_chk )

Determine the programs executed by system start-up files. Determine the ownership of the executed programs.

# cat /etc/rc*/* /etc/init.d/* | more
# ls -l

Alternatively:
# for FILE in `egrep -r "/" /etc/rc.* /etc/init.d|awk '/^.*[^\/][0-9A-Za-z_\/]*/{print $2}'|egrep "^/"|sort|uniq`;do if [ -e $FILE ]; then stat -L -c '%U:%n' $FILE;fi;done

This provides a list of files referenced by initialization scripts and their associated UIDs.
If any file is run by an initialization file and is not owned by root, sys, bin, or in rare cases, an application account, this is a finding.

Fix Text (F-31218r1_fix)
Change the ownership of the file executed from system startup scripts to root, bin, sys, or other. # chown root