documentation_complete: true

prodtype: rhel7,fedora,ol7

title: 'Ensure All SGID Executables Are Authorized'

description: |-
    The SGID (set group id) bit should be set only on files that were
    installed via authorized means. A straightforward means of identifying
    unauthorized SGID files is determine if any were not installed as part of an
    RPM package, which is cryptographically verified. Investigate the origin
    of any unpackaged SGID files.

rationale: |-
    Executable files with the SGID permission run with the privileges of
    the owner of the file. SGID files of uncertain provenance could allow for
    unprivileged users to elevate privileges. The presence of these files should be
    strictly controlled on the system.

severity: unknown

identifiers:
    cce@rhel7: 80132-4

references:
    cis: 6.1.14
    nist: AC-6(1)

ocil_clause: 'there is output'

ocil: |-
    To find world-writable files, run the following command:
    <pre>$ sudo find / -xdev -type f -perm -002</pre>
