# Ensure SUID and SGID files are reviewed (Manual)

Necessity: SUID (Set User ID) and SGID (Set Group ID) permissions allow users to execute a file with the permissions of the file's owner or group, respectively. While required for certain system tasks (e.g., 'passwd', 'sudo'), these permissions can be exploited for privilege escalation if they are set on unauthorized or vulnerable programs. An attacker could leverage such a file to gain root or other privileged access. Regularly reviewing SUID/SGID files is critical to minimize the system's attack surface and prevent unauthorized privilege escalation.

Auditing and Remediation: The audit script inventories all SUID/SGID files on the system and compares this list against a predefined 'golden image' or manifest of approved files. It reports the number of files that are not on the approved list, flagging them for review. Remediation is a deliberate, manual process. An administrator must investigate each flagged file to determine if its permissions are legitimate and necessary. If a file is unauthorized, the SUID/SGID permission is removed using the 'chmod' command. If it is legitimate, the approved list must be updated to include it.

Recommended State Rationale: The recommended state for Basic, Moderate, and Strict levels is '[0, 0]', signifying that there should be zero unapproved SUID/SGID files on the system. This is a binary security condition; a system either adheres to its defined security baseline or it does not. Any unauthorized file with these permissions represents a significant and unacceptable security risk, regardless of the overall hardening level. Therefore, the only acceptable state is a perfect match between the system's configuration and the approved baseline.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `[0, 0]` |
| **Moderate** | `[0, 0]` |
| **Strict** | `[0, 0]` |
| **Type** | `RANGE` |

## Audit Script Working

Bash script that compares the system's current SUID/SGID files against a predefined, approved list of files (e.g., located at '/etc/security/approved_suid_sgid.list'). The script must exclude transient filesystems like '/proc', '/sys', and '/dev'. The script must output only the integer count of files found on the system that have SUID or SGID permissions but are NOT present in the approved list.

## Remediation Script Working

This is a manual review item. Automated remediation that indiscriminately removes permissions is not recommended as it could break essential system functionality. An administrator must review the unapproved files identified by the audit process. For a file deemed unauthorized, create a script that accepts the absolute file path as a command-line argument and removes the SUID/SGID permission using 'chmod u-s,g-s "$1"'. The script must return 'true' on success and 'false' on failure.

