Keep system programs and libraries owned by root and not writable by others

Description

In the system program and library directories (/usr/bin, /usr/sbin, /usr/lib, /usr/lib64, /usr/libexec, /usr/local/bin, /usr/local/sbin, /usr/local/lib, and /bin, /sbin, /lib, /lib64 when they are real directories):

• every directory belongs to root:root and is not writable by group or others;
• every file belongs to root and is not writable by group or others.

Files may belong to another group: Debian ships setgid helpers owned by groups such as shadow, _ssh or messagebus.

A deviation here usually means software installed outside the package manager, or tampering. The fix is therefore manual: find the cause before changing the owner, because chown also clears setuid and setgid bits.

Rationale

Programs in these directories run as root through services, cron, sudo and package scripts, and libraries are loaded into every process. Write access for anyone but root lets that account replace them and gain root, or persist unnoticed.

Impact

None on a standard system, where packages install everything as root. Software installed by hand under /usr/local by a regular user must be given to root.

Audit

Run, for each of the directories above that exists and is not a symbolic link:

find <dir> -xdev \( -type d \( ! -user root -o ! -group root -o -perm /022 \) \) -o \( ! -type d ! -type l \( ! -user root -o -perm /022 \) \) -print

The command must print nothing.

Automated: every check must pass. Scanners report each check by its id.

system-dirs

Owner, group and write bits of directories and files in system program and library directories.

script: |
  out=$(for d in /usr/bin /usr/sbin /usr/lib /usr/lib64 /usr/libexec /usr/local/bin /usr/local/sbin /usr/local/lib /bin /sbin /lib /lib64; do
    [ -d "$d" ] && [ ! -L "$d" ] || continue
    find "$d" -xdev \( \( -type d \( ! -user root -o ! -group root -o -perm /022 \) \) -o \
      \( ! -type d ! -type l \( ! -user root -o -perm /022 \) \) \) -print 2>/dev/null
  done | sort -u)
  [ -z "$out" ] && { echo "system programs and libraries belong to root and are not writable by others"; exit 0; }
  echo "$(printf '%s\n' "$out" | wc -l) item(s):"
  printf '%s\n' "$out" | head -n 20 | while IFS= read -r f; do stat -c '%A %U:%G %n' "$f"; done
  exit 1

Remediation

For each reported item:

1. Find its package with dpkg -S <path> and check it with dpkg --verify <package>. A changed file from a package is a possible compromise: investigate first, then reinstall the package with apt-get install --reinstall <package>.
2. For files installed by hand, run chown root <path> (then restore any setuid or setgid bit that was intended) and chmod go-w <path>; for directories, chown root:root <dir> and chmod go-w <dir>.

References

• file-hierarchy(7), Debian manual pages Debian, vendor-doc, accessed 2026-10-18
• dpkg(1), Debian manual pages (--verify) Debian, vendor-doc, accessed 2026-10-18
• ANSSI-BP-028 v2.0 - Recommandations de configuration d'un système GNU/Linux (R50) ANSSI, guide, accessed 2026-10-18

Mappings

How this control relates to the other framework's: equivalent, stricter, looser, partial or related.

Threats mitigated

Related controls

• related CB-DEB-FS-010 Review setuid and setgid programs and keep only those that are needed

People and lifecycle