Keep system programs and libraries owned by root and not writable by others

Description

In the system program and library directories (/usr/bin, /usr/sbin, /usr/lib, /usr/lib64, /usr/libexec, /usr/local/bin, /usr/local/sbin, /usr/local/lib, and /bin, /sbin, /lib, /lib64 when they are real directories):

• every directory belongs to root:root and is not writable by group or others;
• every file belongs to root and is not writable by group or others.

Files may belong to another group: Ubuntu ships setgid helpers owned by groups such as shadow, _ssh or messagebus. Two packaging exceptions are accepted:

• the files of {{ owner_exceptions }} (format path:owner) may belong to that owner, as long as group and others cannot write them;
• directories under /usr/local may be root:staff and writable by group staff, as long as that group has no member.

A deviation here usually means software installed outside the package manager, or tampering. The fix is therefore manual: find the cause before changing the owner, because chown also clears setuid and setgid bits.

Ubuntu 20.04 has both exceptions on a fresh install: the at package installs /usr/bin/at setuid and setgid daemon:daemon, and Python creates /usr/local/lib/python3.8 group-writable by staff, an old Debian convention for letting local administrators install into /usr/local. Members of staff can plant code that root runs (a Python module, for example), so they count as root: the check fails as soon as the group has a member. Ubuntu 22.04 and later no longer have either.

Rationale

Programs in these directories run as root through services, cron, sudo and package scripts, and libraries are loaded into every process. Write access for anyone but root lets that account replace them and gain root, or persist unnoticed.

Impact

None on a standard system, where packages install everything as root. Software installed by hand under /usr/local by a regular user must be given to root.

Parameters

The value used is your override (tailoring file), else the profile's, else the one of the profile it extends, else the default. Bounds limit what an override may set.

Audit

Run, for each of the directories above that exists and is not a symbolic link:

find <dir> -xdev \( -type d \( ! -user root -o ! -group root -o -perm /022 \) \) -o \( ! -type d ! -type l \( ! -user root -o -perm /022 \) \) -print

The command must print nothing.

Automated: every check must pass. Scanners report each check by its id.

system-dirs

Owner, group and write bits of directories and files in system program and library directories.

script: |
  out=$(for d in /usr/bin /usr/sbin /usr/lib /usr/lib64 /usr/libexec /usr/local/bin /usr/local/sbin /usr/local/lib /bin /sbin /lib /lib64; do
    [ -d "$d" ] && [ ! -L "$d" ] || continue
    find "$d" -xdev \( \( -type d \( ! -user root -o ! -group root -o -perm /022 \) \) -o \
      \( ! -type d ! -type l \( ! -user root -o -perm /022 \) \) \) -print 2>/dev/null
  done | sort -u)
  staff=$(getent group staff | cut -d: -f4)
  bad=
  while IFS= read -r f; do
    [ -n "$f" ] || continue
    u=$(stat -c %U "$f") g=$(stat -c %G "$f") m=$(stat -c %a "$f")
    ok=0
    for e in $CB_OWNER_EXCEPTIONS; do [ "$e" = "$f:$u" ] && ok=1; done
    if [ "$ok" = 1 ] && [ $((0$m & 022)) -eq 0 ]; then
      echo "accepted: $f owned by $u"; continue
    fi
    case $f in /usr/local/*)
      if [ -d "$f" ] && [ "$u:$g" = root:staff ] && [ -z "$staff" ] && [ $((0$m & 02)) -eq 0 ]; then
        echo "accepted: $f writable by group staff, which has no member"; continue
      fi ;;
    esac
    bad="$bad$f
  "
  done <<EOF
  $out
  EOF
  [ -z "$bad" ] && { echo "system programs and libraries belong to root and are not writable by others"; exit 0; }
  echo "$(printf '%s' "$bad" | wc -l) item(s):"
  printf '%s' "$bad" | head -n 20 | while IFS= read -r f; do stat -c '%A %U:%G %n' "$f"; done
  exit 1

Remediation

For each reported item (the exceptions of the description aside):

1. Find its package with dpkg -S <path> and check it with dpkg --verify <package>. A changed file from a package is a possible compromise: investigate first, then reinstall the package with apt-get install --reinstall <package>.
2. For files installed by hand, run chown root <path> (then restore any setuid or setgid bit that was intended) and chmod go-w <path>; for directories, chown root:root <dir> and chmod go-w <dir>.
3. Under /usr/local, either keep group staff without members, or run chmod -R g-w /usr/local and chgrp -R root /usr/local.

References

• file-hierarchy(7), Ubuntu manual pages Canonical, vendor-doc, accessed 2026-10-19
• dpkg(1), Ubuntu manual pages (--verify) Canonical, vendor-doc, accessed 2026-10-19
• ANSSI-BP-028 v2.0 - Recommandations de configuration d'un système GNU/Linux (R50) ANSSI, guide, accessed 2026-10-19

Mappings

How this control relates to the other framework's: equivalent, stricter, looser, partial or related.

Threats mitigated

Related controls

• related CB-UBU-FS-010 Review setuid and setgid programs and keep only those that are needed

People and lifecycle