System start-up files must only execute programs owned by a privileged UID or an application.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-4091	GEN001700	SV-27219r1_rule	DCSL-1	Medium

Description
System start-up files executing programs owned by other than root (or another privileged user) or an application indicates the system may have been compromised.

STIG	Date
SOLARIS 9 SPARC SECURITY TECHNICAL IMPLEMENTATION GUIDE	2015-10-01

Details

Check Text ( C-28197r2_chk )
Determine the programs executed by system start-up files. Determine the ownership of the executed programs. # cat /etc/rc* /etc/init.d/* | more Check the ownership of every program executed by the system start-up files. # ls -l If any executed program is not owned by root, sys, bin, or in rare cases, an application account, this is a finding.

Fix Text (F-34270r1_fix)
Change the ownership of the file executed from system startup scripts to root, bin, or sys. # chown root