# yaml-language-server: $schema=../../../../schema/control.schema.json
id: CB-DEB-AUTH-017
title: Keep the root PATH free of relative and writable directories
finding:
  title: The root login PATH contains a relative or writable directory
  description: A command name typed as root can resolve to a program planted by another user.
status: active
profiles: [core]
risk:
  severity: medium
assessment: automated
tags: [accounts, root, path]

description: |
  When root types a command name, the shell searches the directories of `PATH` in order. Each
  entry must be an absolute path to an existing directory owned by root and not writable by
  group or others. Empty entries and `.` mean the current directory.
rationale: |
  If root's `PATH` includes the current directory or a directory another user can write to, that
  user can drop a program named like a common command (`ls`, `sudo`) and have root run it.
impact: |
  None for the Debian default PATH. Scripts that relied on running programs from the current
  directory must use `./program`.

audit:
  manual: |
    Run `su - root -c 'echo $PATH'`. It must have no empty entry, no `.`, no relative path, and
    each directory must exist, be owned by root and not be group or world writable.
  checks:
    - id: root-path
      engine: shell
      description: PATH of a root login shell.
      spec:
        script: |
          p=$(su - root -c 'printf %s "$PATH"' 2>/dev/null) || exit 3
          echo "PATH=$p"
          case ":$p:" in *::* | *:.:*) echo "empty or . entry"; exit 1 ;; esac
          rc=0
          IFS=:
          for d in $p; do
            case $d in /*) ;; *) echo "relative: $d"; rc=1; continue ;; esac
            [ -d "$d" ] || continue
            [ "$(stat -L -c %U "$d")" = root ] || { echo "not owned by root: $d"; rc=1; }
            m=$(stat -L -c %a "$d")
            [ $(( 0$m & 022 )) -eq 0 ] || { echo "group/world writable: $d ($m)"; rc=1; }
          done
          exit $rc

remediation:
  manual: |
    Remove empty, `.` and relative entries from the PATH set in `/root/.profile`, `/root/.bashrc`,
    `/etc/profile` and `/etc/environment`. Fix the owner and mode of any listed directory with
    `chown root:root` and `chmod go-w`.

references:
  - title: bash(1), Debian manual pages (PATH)
    url: https://manpages.debian.org/trixie/bash/bash.1.en.html
    publisher: Debian
    kind: vendor-doc
    accessed: 2026-10-18
mappings:
  - framework: nist-800-53r5
    framework_version: "5.1.1"
    id: CM-6
    relation: related
  - framework: cis-debian-12
    framework_version: "2.0.0"
    id: "5.4.2.5"
    relation: equivalent
  - framework: cis-debian-13
    framework_version: "1.1.0"
    id: "5.4.2.5"
    relation: equivalent
threats:
  - framework: mitre-attack
    id: T1574.007
  - framework: cwe
    id: CWE-427

authors:
  - name: Alice
    github: Sn0wAlice
verified:
  - date: 2026-10-18
    by: Sn0wAlice
    versions: ["12"]
    environment: Proxmox VM, Debian 12 genericcloud image, kernel 6.1.0-54-cloud-amd64
    notes: Generated check, fix and check again for profiles core and server-hardened; state kept after reboot.
  - date: 2026-10-18
    by: Sn0wAlice
    versions: ["13"]
    environment: Proxmox VM, Debian 13 genericcloud image, kernel 6.12.113+deb13-cloud-amd64
    notes: Generated check, fix and check again for profiles core and server-hardened; state kept after reboot.
introduced_in: 0.1.0
created: 2026-10-18
updated: 2026-10-18