{"description": "Set the mode on files being executed by the user initialization files with the\nfollowing command:\n<pre>$ sudo chmod o-w <i>FILE</i></pre>", "rationale": "If user start-up files execute world-writable programs, especially in\nunprotected directories, they could be maliciously modified to destroy user\nfiles or otherwise compromise the system at the user level. If the system is\ncompromised at the user level, it is easier to elevate privileges to eventually\ncompromise the system at the root and network level.", "severity": "medium", "references": {"srg": ["SRG-OS-000480-GPOS-00227"]}, "control_references": {}, "components": [], "identifiers": {}, "ocil_clause": "any local initialization files are found to reference world-writable files", "ocil": "Verify that local initialization files do not execute world-writable programs with the following command:\n\nNote: The example will be for a system that is configured to create user home directories in the \"/home\" directory.\n\n<pre>$ sudo find /home -perm -002 -type f -name \".[^.]*\" -exec ls -ld {} \\;</pre>", "oval_external_content": null, "fixtext": "Set the mode on files being executed by the local initialization files with the following command:\n\n$ sudo chmod 0755 &lt;file&gt;", "checktext": "", "vuldiscussion": "", "srg_requirement": "Local Ubuntu 22.04 initialization files must not execute world-writable programs.", "warnings": [], "conflicts": [], "requires": [], "policy_specific_content": {"stig": {"srg_requirement": "Local Ubuntu 22.04 initialization files must not execute world-writable programs.", "vuldiscussion": "If user start-up files execute world-writable programs, especially in unprotected directories, they could be maliciously modified to destroy user files or otherwise compromise the system at the user level. If the system is compromised at the user level, it is easier to elevate privileges to eventually compromise the system at the root and network level.", "checktext": "Verify that local initialization files do not execute world-writable programs with the following command:\n\nNote: The example will be for a system that is configured to create user home directories in the \"/home\" directory.\n\n$ sudo find /home -perm -002 -type f -name \".[^.]*\" -exec ls -ld {} \\;\n\nIf any local initialization files are found to reference world-writable files, this is a finding.", "fixtext": "Set the mode on files being executed by the local initialization files with the following command:\n\n$ sudo chmod 0755 &lt;file&gt;"}}, "platform": "system_with_kernel", "platforms": ["system_with_kernel"], "sce_metadata": {}, "inherited_platforms": [], "cpe_platform_names": ["system_with_kernel"], "inherited_cpe_platform_names": [], "bash_conditional": null, "fixes": {}, "title": "User Initialization Files Must Not Run World-Writable Programs", "definition_location": "/aptdata/openscap/scap-security-guide/linux_os/guide/system/accounts/accounts-session/accounts_user_dot_no_world_writable_programs/rule.yml", "template": null}