# Ensure root path integrity

The PATH environment variable dictates the directories the shell searches for executable programs. Ensuring root's path integrity is a critical security measure. If the PATH includes the current directory ('.') or any directories that are writable by non-root users (group-writable or world-writable), an attacker could place a malicious executable with the same name as a common system command (e.g., 'ls', 'ps') in one of these directories. When the root user executes that command, the malicious version would run instead of the legitimate one, leading to immediate privilege escalation and full system compromise. The audit script checks the root user's PATH for these specific insecure conditions. The remediation script systematically removes such entries from the root user's shell configuration files, ensuring that only trusted, secure directories are used for command execution. This is a foundational security control with no acceptable variance; therefore, the Basic, Moderate, and Strict states all recommend a 'Secure' configuration. Any deviation introduces an unacceptable risk of a Trojan horse attack.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['Secure']` |
| **Moderate** | `['Secure']` |
| **Strict** | `['Secure']` |
| **Type** | `ENUM` |

## Audit Script Working

bash script that impersonates the root user to retrieve the root user's PATH environment variable. The script must execute `sudo -i printenv PATH` and output only the raw string value of the PATH variable with no additional text or formatting. The script must also check each directory in the path for group or world writability and check for the presence of '.' (the current directory). The script should return a single string: 'Secure' if no insecure entries are found, or 'Insecure' if any are found.

## Remediation Script Working

bash script that accepts a single positional argument, which must be the string 'secure'. The script must locate the relevant shell configuration files for the root user (e.g., `/etc/profile`, `/root/.bash_profile`, `/root/.bashrc`). It will then parse the PATH definitions within these files, programmatically removing any instance of the current directory ('.') and any directory that is group-writable or world-writable. The script must return `true` on successful sanitization and `false` on failure.

