documentation_complete: true


title: 'Root Path Must Be Vendor Default'

description: |-
    Assuming root shell is bash, edit the following files:
    <pre>~/.profile</pre>
    <pre>~/.bashrc</pre>
    Change any <tt>PATH</tt> variables to the vendor default for root and remove any
    empty <tt>PATH</tt> entries or references to relative paths.

rationale: |-
    The root account's executable search path must be the vendor default, and must
    contain only absolute paths.

severity: unknown

references:
    cis-csc: '18'
    cobit5: APO13.01,BAI03.01,BAI03.02,BAI03.03
    isa-62443-2009: 4.3.4.3.3
    iso27001-2013: A.14.1.1,A.14.2.1,A.14.2.5,A.6.1.5
    nist: CM-6(a)
    nist-csf: PR.IP-2

ocil_clause: 'any of these conditions are not met'

ocil: |-
    To view the root user's <tt>PATH</tt>, run the following command:
    <pre>$ sudo env | grep PATH</pre>
    If correctly configured, the <tt>PATH</tt> must: use vendor default settings,
    have no empty entries, and have no entries beginning with a character
    other than a slash (/).
