{
  "id": "CB-UBU-AUTH-017",
  "standard": "ubuntu",
  "version": "0.1.1",
  "url": "https://baselines.cirsec.org/b/ubuntu/v0.1.1/CB-UBU-AUTH-017",
  "json": "https://baselines.cirsec.org/b/ubuntu/v0.1.1/CB-UBU-AUTH-017.json",
  "yaml": "https://baselines.cirsec.org/b/ubuntu/v0.1.1/CB-UBU-AUTH-017.yml",
  "profiles_effective": [
    "core",
    "server",
    "server-hardened",
    "desktop",
    "desktop-hardened"
  ],
  "license": "Text CC BY 4.0, code Apache-2.0",
  "attribution": "CIRSEC Baselines, https://baselines.cirsec.org",
  "control": {
    "id": "CB-UBU-AUTH-017",
    "title": "Keep the root PATH free of relative and writable directories",
    "finding": {
      "title": "The root login PATH contains a relative or writable directory",
      "description": "A command name typed as root can resolve to a program planted by another user."
    },
    "status": "active",
    "profiles": [
      "core"
    ],
    "risk": {
      "severity": "medium"
    },
    "assessment": "automated",
    "tags": [
      "accounts",
      "root",
      "path"
    ],
    "description": "When root types a command name, the shell searches the directories of `PATH` in order. Each\nentry must be an absolute path to an existing directory owned by root and not writable by\ngroup or others. Empty entries and `.` mean the current directory.\n",
    "rationale": "If root's `PATH` includes the current directory or a directory another user can write to, that\nuser can drop a program named like a common command (`ls`, `sudo`) and have root run it.\n",
    "impact": "None for the Ubuntu default PATH. Scripts that relied on running programs from the current\ndirectory must use `./program`.\n",
    "audit": {
      "manual": "Run `su - root -c 'echo $PATH'`. It must have no empty entry, no `.`, no relative path, and\neach directory must exist, be owned by root and not be group or world writable.\n",
      "checks": [
        {
          "id": "root-path",
          "engine": "shell",
          "description": "PATH of a root login shell.",
          "spec": {
            "script": "p=$(su - root -c 'printf %s \"$PATH\"' 2>/dev/null) || exit 3\necho \"PATH=$p\"\ncase \":$p:\" in *::* | *:.:*) echo \"empty or . entry\"; exit 1 ;; esac\nrc=0\nIFS=:\nfor d in $p; do\n  case $d in /*) ;; *) echo \"relative: $d\"; rc=1; continue ;; esac\n  [ -d \"$d\" ] || continue\n  [ \"$(stat -L -c %U \"$d\")\" = root ] || { echo \"not owned by root: $d\"; rc=1; }\n  m=$(stat -L -c %a \"$d\")\n  [ $(( 0$m & 022 )) -eq 0 ] || { echo \"group/world writable: $d ($m)\"; rc=1; }\ndone\nexit $rc\n"
          }
        }
      ]
    },
    "remediation": {
      "manual": "Remove empty, `.` and relative entries from the PATH set in `/root/.profile`, `/root/.bashrc`,\n`/etc/profile` and `/etc/environment`. Fix the owner and mode of any listed directory with\n`chown root:root` and `chmod go-w`.\n"
    },
    "references": [
      {
        "title": "bash(1), Ubuntu manual pages (PATH)",
        "url": "https://manpages.ubuntu.com/manpages/noble/man1/bash.1.html",
        "publisher": "Canonical",
        "kind": "vendor-doc",
        "accessed": "2026-10-19"
      }
    ],
    "mappings": [
      {
        "framework": "nist-800-53r5",
        "framework_version": "5.1.1",
        "id": "CM-6",
        "relation": "related"
      }
    ],
    "threats": [
      {
        "framework": "mitre-attack",
        "id": "T1574.007"
      },
      {
        "framework": "cwe",
        "id": "CWE-427"
      }
    ],
    "authors": [
      {
        "name": "Alice",
        "github": "Sn0wAlice"
      }
    ],
    "verified": [
      {
        "date": "2026-10-19",
        "by": "Sn0wAlice",
        "versions": [
          "20.04"
        ],
        "environment": "Proxmox VM, Ubuntu 20.04 cloud image, kernel 5.4.0-216-generic",
        "notes": "Passes on a fresh install; profiles core and server-hardened."
      },
      {
        "date": "2026-10-19",
        "by": "Sn0wAlice",
        "versions": [
          "22.04"
        ],
        "environment": "Proxmox VM, Ubuntu 22.04 cloud image, kernel 5.15.0-198-generic",
        "notes": "Passes on a fresh install; profiles core and server-hardened."
      },
      {
        "date": "2026-10-19",
        "by": "Sn0wAlice",
        "versions": [
          "24.04"
        ],
        "environment": "Proxmox VM, Ubuntu 24.04 cloud image, kernel 6.8.0-147-generic",
        "notes": "Passes on a fresh install; profiles core and server-hardened."
      },
      {
        "date": "2026-10-19",
        "by": "Sn0wAlice",
        "versions": [
          "26.04"
        ],
        "environment": "Proxmox VM, Ubuntu 26.04 cloud image, kernel 7.0.0-38-generic",
        "notes": "Passes on a fresh install; profiles core and server-hardened."
      }
    ],
    "introduced_in": "0.1.0",
    "created": "2026-10-19",
    "updated": "2026-10-19"
  }
}