documentation_complete: true

title: "Ensure rootfiles tmpfile.d is Configured Correctly"

description: |-
    To set the mode of the root user initialization file <tt>/root/.bash_profile</tt>,
    ensure the following lines are is included in a file ending in <tt>.conf</tt> under
    <tt>/etc/tmpfiles.d/</tt>.
    <pre>
        C /root/.bash_logout   600 root root - /usr/share/rootfiles/.bash_logout
        C /root/.bash_profile  600 root root - /usr/share/rootfiles/.bash_profile
        C /root/.bashrc        600 root root - /usr/share/rootfiles/.bashrc
        C /root/.cshrc         600 root root - /usr/share/rootfiles/.cshrc
        C /root/.tcshrc        600 root root - /usr/share/rootfiles/.tcshrc
    </pre>

rationale: |-
    Local initialization files are used to configure the user's shell environment
    upon logon. Malicious modification of these files could compromise accounts upon
    logon.

identifiers:
    cce@rhel8: CCE-86473-6
    cce@rhel9: CCE-86474-4
    cce@rhel10: CCE-86476-9

references:
    srg: SRG-OS-000480-GPOS-00227

ocil_clause: 'that rootfiles are not configured correctly'

ocil: |-
    Check the all files from <tt>/usr/share/rootfiles/</tt> are overridden correctly.
    <pre>
        $ grep /usr/share/rootfiles/.bash_logout *.conf
        C /root/.bash_logout   600 root root - /usr/share/rootfiles/.bash_logout
        C /root/.bash_profile  600 root root - /usr/share/rootfiles/.bash_profile
        C /root/.bashrc        600 root root - /usr/share/rootfiles/.bashrc
        C /root/.cshrc         600 root root - /usr/share/rootfiles/.cshrc
        C /root/.tcshrc        600 root root - /usr/share/rootfiles/.tcshrc
    </pre>


fixtext: |-
    Ensure the following lines are in <tt>.conf</tt> file under <tt>/etc/tmpfiles.d/</tt>.
    <pre>
        C /root/.bash_logout   600 root root - /usr/share/rootfiles/.bash_logout
        C /root/.bash_profile  600 root root - /usr/share/rootfiles/.bash_profile
        C /root/.bashrc        600 root root - /usr/share/rootfiles/.bashrc
        C /root/.cshrc         600 root root - /usr/share/rootfiles/.cshrc
        C /root/.tcshrc        600 root root - /usr/share/rootfiles/.tcshrc
    </pre>

severity: medium

platform: package[rootfiles]
