System start-up files must only execute programs owned by a privileged UID or an application.
Severity | Group ID | Group Title | Version | Rule ID | Date | STIG Version |
|---|---|---|---|---|---|---|
| medium | V-216072 | SRG-OS-000480 | SOL-11.1-020380 | SV-216072r959010_rule | 2026-02-19 | 3 |
Description
System start-up files executing programs owned by other than root (or another privileged user) or an application indicates the system may have been compromised.
ℹ️ Check
Determine the programs executed by system start-up files. Determine the ownership of the executed programs.
# cat /etc/rc* /etc/init.d/* | more
Check the ownership of every program executed by the system start-up files.
# ls -l <executed program>
If any executed program is not owned by root, sys, bin, or in rare cases, an application account, this is a finding.
✔️ Fix
Change the ownership of the file executed from system startup scripts to root, bin, or sys.
# chown root <executed file>