documentation_complete: true


title: 'Verify Owner on cron.yearly'

description: |-
    {{{ describe_file_owner(file="/etc/cron.yearly", owner="root") }}}

rationale: |-
    Service configuration files enable or disable features of their respective services that if configured incorrectly
    can lead to insecure and vulnerable configurations. Therefore, service configuration files should be owned by the
    correct user to prevent unauthorized changes.

severity: medium

identifiers:
    cce@rhel8: CCE-88838-8
    cce@rhel10: CCE-90735-2

references:
    cis-csc: 12,13,14,15,16,18,3,5
    cis@sle12: 5.1.6
    cis@sle15: 5.1.6
    cobit5: APO01.06,DSS05.04,DSS05.07,DSS06.02
    isa-62443-2009: 4.3.3.7.3
    isa-62443-2013: 'SR 2.1,SR 5.2'
    iso27001-2013: A.10.1.1,A.11.1.4,A.11.1.5,A.11.2.1,A.13.1.1,A.13.1.3,A.13.2.1,A.13.2.3,A.13.2.4,A.14.1.2,A.14.1.3,A.6.1.2,A.7.1.1,A.7.1.2,A.7.3.1,A.8.2.2,A.8.2.3,A.9.1.1,A.9.1.2,A.9.2.3,A.9.4.1,A.9.4.4,A.9.4.5
    nist: CM-6(a),AC-6(1)
    nist-csf: PR.AC-4,PR.DS-5
    srg: SRG-OS-000480-GPOS-00227

ocil_clause: '{{{ ocil_clause_file_owner(file="/etc/cron.yearly", owner="root") }}}'

ocil: |-
    {{{ ocil_file_owner(file="/etc/cron.yearly", owner="root") }}}

fixtext: '{{{ fixtext_directory_owner(file="/etc/cron.yearly/", owner="root") }}}'

srg_requirement: '{{{ srg_requirement_directory_owner(file="/etc/cron.yearly", owner="root") }}}'

template:
    name: file_owner
    vars:
        filepath: /etc/cron.yearly/
        uid_or_name: '0'
