# Ensure permissions on /etc/shells are configured

Necessity: The `/etc/shells` file contains a list of valid login shells. If this file is writable by non-root users, an attacker could add a malicious script to the list. Subsequently, if they can assign this malicious script as the shell for a user account, the script will be executed upon login, potentially leading to privilege escalation or persistent unauthorized access. Ensuring the file is not world-writable is critical to maintaining system integrity.

Auditing and Remediation: The audit script retrieves the current file permissions of `/etc/shells` in octal notation (e.g., '644'). The remediation script uses the `chmod` command to apply the specified octal permission set to the file, ensuring it conforms to the security policy.

Recommended State Rationale:
- **Basic/Moderate (`['644']`):** This is the standard secure configuration. It sets the owner (root) with read/write permissions, while the owner's group and all other users have read-only access. This prevents any unauthorized user from modifying the list of valid shells while allowing all users and system processes to read it, which is necessary for normal operation.
- **Strict (`['640']`):** This configuration enhances security by restricting read access to only the root user and members of the root group. It removes read permissions for all other users, adhering to the principle of least privilege. This prevents unprivileged users from enumerating the system's available shells, mitigating a minor information disclosure vector in highly sensitive environments.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['644']` |
| **Moderate** | `['644']` |
| **Strict** | `['640']` |
| **Type** | `ENUM` |

## Audit Script Working

Bash script that queries the permissions for the /etc/shells file. The script should use a command like `stat -c "%a" /etc/shells` and output only the numeric permission value (e.g., '644') with no additional text or formatting.

## Remediation Script Working

Bash script that accepts a single positional command-line argument representing the desired file permissions in octal format (e.g., '644'). The script should use this argument to set the permissions on the /etc/shells file using the `chmod` command. It must return 'true' on successful execution and 'false' on failure.

