# Ensure SUID and SGID files are reviewed (Manual)

Necessity: SUID (Set User ID) and SGID (Set Group ID) permissions allow users to run executables with the permissions of the file's owner or group, respectively. While necessary for some system functions (e.g., `passwd`), these permissions can pose a significant security risk. If an attacker finds a vulnerability in an SUID root program, they can exploit it to gain full root privileges. Misconfigured or unnecessary SUID/SGID files create a larger attack surface, increasing the risk of privilege escalation attacks. Regular review and minimization of such files are critical for maintaining system integrity. Auditing and Remediation: The audit script instruction details how to use the 'find' command to recursively search the filesystem for any files with the SUID or SGID permission bit set. This generates a comprehensive list for an administrator to analyze. Since this is a manual control, remediation is not automatic. The remediation script instruction describes creating a tool for an administrator to use after their review. By providing a file path, the script removes the elevated permissions from any file deemed unnecessary or risky. Recommended State Rationale: Basic: ['Reviewed'] - The fundamental requirement is to perform an initial, comprehensive review of all SUID/SGID files. This establishes a secure baseline by removing permissions from any non-essential executables. Moderate: ['Reviewed Periodically'] - Systems evolve through software updates and new installations, which can introduce new SUID/SGID files. A moderate security posture requires implementing a recurring process (e.g., quarterly) to re-audit the system, ensuring that the hardened state is maintained and new risks are promptly identified. Strict: ['Reviewed Periodically with Automated Monitoring'] - The most robust security posture combines periodic manual reviews with an automated system. This involves using file integrity monitoring tools (like AIDE or Tripwire) or custom scripts to provide immediate alerts whenever a new SUID/SGID file is created. This proactive approach drastically reduces the window of exposure from a newly introduced, potentially vulnerable file.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['Reviewed']` |
| **Moderate** | `['Reviewed Periodically']` |
| **Strict** | `['Reviewed Periodically with Automated Monitoring']` |
| **Type** | `ENUM` |

## Audit Script Working

Bash script that executes the command 'find / -xdev -type f \( -perm -4000 -o -perm -2000 \) -print 2>/dev/null'. The script must output only the list of file paths, with each path on a new line, and suppress any error messages.

## Remediation Script Working

This is a manual control requiring administrator review. Create a supporting Bash script that accepts a single positional argument, which is the full path to a file. The script should execute 'chmod u-s,g-s "$1"' to remove the SUID and SGID bits from the specified file. The script must return 'true' if the command succeeds and 'false' if it fails.

