Ensure that All Entries in The Path of Root Are Directories
Ensures root's PATH has no empty or . entries and that every directory in it is not writable by group or other.
Checked against the content of a persistent configuration file, the source of truth that survives reboots.
A mapping is a cross-reference to where each standard places this requirement, anchored and cross-validated, not a claim of equivalence. A passing check is evidence toward these references, how to read it.
Why this rule matters
root's PATH must contain only secure directories. An empty entry, a relative . entry, or a directory writable by group/other lets an unprivileged user plant a malicious binary that root then runs with full privileges, a classic PATH-hijacking privilege escalation. Removing empty/. entries and tightening directory permissions keeps every command root executes coming from a trusted location.
What Pavois checks
Pavois reads the effective PATH from the environment (os_env('PATH')) and then stats each directory, so it audits the value root actually resolves commands against, not a static line in /etc/profile or /etc/environment. A file-based scan would miss a PATH mutated by a shell rc, a drop-in, or a profile snippet; the resolved environment is the only source of truth.
rp = os_env('PATH').content.to_s.split(':')
describe rp do
it { should_not be_empty }
it { should_not include '' }
it { should_not include '.' }
end
rp.reject { |d| d.empty? || d == '.' }.each do |d|
describe file(d) do
it { should_not be_writable.by 'group' }
it { should_not be_writable.by 'other' }
end
endHow to verify it is applied
As root, run echo "$PATH", it must contain no empty segment (no ::, no leading/trailing :) and no .. Then check each entry's permissions, e.g. ls -ld /usr/local/sbin /usr/local/bin /usr/sbin /usr/bin: none should show write bits for group or other (no w in positions 6 or 9).
Inspect & investigate
There is no dedicated log for this rule. Inspect the live state with echo "$PATH" and ls -ld <each directory>. If auditd watches the affected directories, file-creation or permission-change events appear in /var/log/audit/audit.log.
Remediation
No automated harden plan is defined for this rule, so it must be applied manually. Remove any empty or . entries from root's PATH (edit the shell profile / /etc/environment that sets it), and tighten any over-permissive directory with e.g. chmod g-w,o-w <dir> (or chown root <dir> if it is owned by a non-root user). Re-run pavois harden verify to confirm.
Pavois applies this with its own harden engine, the plan below, not a shell script:
| command | sudo -l 2>/dev/null | grep -i secure_path; grep -rE 'PATH=' /root/.bashrc /root/.profile /etc/profile 2>/dev/null # ensure no empty entry, no '.', no world-writable dir; fix in the relevant file |
|---|---|
| reason | fixing root's PATH may be in a shell profile or sudoers secure_path, review the source |
| resource | manual |
pavois harden plan localwhere the target is local, a user@host SSH alias, or a container , Docs
Impact & precautions
Removing a . or empty entry from PATH can break scripts that implicitly rely on running commands from the current directory, audit such scripts and call binaries by absolute path instead. Tightening directory permissions with chmod g-w/o-w could disrupt tooling that legitimately writes there; confirm the directory is a system bin path before changing it. None of these changes risk a lockout, but test in a shell before persisting them to root's profile.
Standards mapping
| Standard | Reference | Type | Version | Confidence |
|---|---|---|---|---|
| CIS | 5.4.2.5 | direct | per OS, see the benchmark table | high |
Each reference is a cross-reference anchored in the upstream benchmark and cross-validated against the SCAP Security Guide and ansible-lockdown, not a claim of equivalence. Direct = a prescriptive, line-level requirement; supporting = an abstract control family (NIST) the check provides evidence toward. How to read a mapping.