AOSX-13-001145 - All setuid executables on the macOS system must be documented.

Information

Very few of the executables that come preinstalled on the macOS host have the 'setuid' bit set, and administrators should never add the 'setuid' bit to any executable that does not already have it set by the vendor. Executables with the 'setuid' bit set allow anyone that executes them to be temporarily assigned the UID of the file owner. In practice, this almost always is the root account. While some vendors depend on this file attribute for proper operation, security problems can result if 'setuid' is assigned to programs allowing reading and writing of files, or shell escapes, as this could lead to unprivileged users gaining privileged access to files and directories on the system.

NOTE: Nessus has provided the target output to assist in reviewing the benchmark to ensure target compliance.

Solution

Document all of the files with the 'setuid' bit set.

Remove any undocumented files.

See Also

https://dl.dod.cyber.mil/wp-content/uploads/stigs/zip/U_Apple_OS_X_10-13_V2R5_STIG.zip

Item Details

Category: CONFIGURATION MANAGEMENT

References: 800-53|CM-6b., CAT|II, CCI|CCI-000366, Rule-ID|SV-214908r609363_rule, STIG-ID|AOSX-13-001145, STIG-Legacy|SV-96409, STIG-Legacy|V-81695, Vuln-ID|V-214908

Plugin: Unix

Control ID: fbe845304f74b34fea07fd0145e26063b43ffddd8458281165b07ebeb3d820c2