# Ensure root path integrity

The root user's `PATH` environment variable defines the directories the system searches for executable files. Ensuring its integrity is critical to prevent privilege escalation and trojan horse attacks. If a directory in the `PATH` is writable by unprivileged users, an attacker could place a malicious executable with the same name as a common command (e.g., 'ls', 'ps'). When the root user executes that command, the malicious version runs instead, compromising the system. Similarly, including the current directory ('.') in the `PATH` is dangerous because an attacker could place a malicious file in a directory and trick the root user into executing it. The audit script verifies that the `PATH` does not contain insecure elements like world/group-writable directories or references to the current directory. The remediation script resets the root `PATH` to a minimal, known-safe set of standard system binary locations. The recommended state is uniformly 'Secure' across all levels because this control is binary; the `PATH` is either secure or it is not. Any deviation from a secure configuration presents a significant security risk, making 'Secure' the only acceptable state for basic, moderate, and strict hardening levels.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['Secure']` |
| **Moderate** | `['Secure']` |
| **Strict** | `['Secure']` |
| **Type** | `ENUM` |

## Audit Script Working

shell script to audit the integrity of the root user's `PATH` environment variable. The script should check for two conditions: 1) The path does not contain the current working directory ('.') or an empty directory field (:: or trailing :). 2) No directory in the path is writable by any user other than its owner (i.e., not group-writable or world-writable). The script must output 'Secure' if both conditions are met, and 'Insecure' otherwise. No other text should be printed.

## Remediation Script Working

shell script that modifies the root user's shell configuration (e.g., /root/.profile or /root/.bashrc) to set a secure `PATH`. The script should accept one argument: 'secure'. When called with this argument, it will set the `PATH` to a known-good, minimal value such as '/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin'. The script must return `true` on success and `false` on failure.

