diff --git a/controls/cis_almalinux9.yml b/controls/cis_almalinux9.yml index 0b8a8ecaf071..29fa4bd9b124 100644 --- a/controls/cis_almalinux9.yml +++ b/controls/cis_almalinux9.yml @@ -2131,8 +2131,6 @@ controls: - l1_workstation status: partial notes: |- - The rule confirms the primary group for root, but doesn't check if any other user are also - using GID 0. New rule is necessary. There is assessment but no automated remediation for this rule and this sounds reasonable. rules: - accounts_root_gid_zero diff --git a/controls/cis_fedora.yml b/controls/cis_fedora.yml index f8dc196ddb89..13bb76495401 100644 --- a/controls/cis_fedora.yml +++ b/controls/cis_fedora.yml @@ -2289,8 +2289,6 @@ controls: - l1_workstation status: partial notes: |- - The rule confirms the primary group for root, but doesn't check if any other user are also - using GID 0. New rule is necessary. There is assessment but no automated remediation for this rule and this sounds reasonable. rules: - accounts_root_gid_zero diff --git a/controls/cis_rhel10.yml b/controls/cis_rhel10.yml index b246da01152a..4991435e0f1d 100644 --- a/controls/cis_rhel10.yml +++ b/controls/cis_rhel10.yml @@ -2233,8 +2233,6 @@ controls: - l1_workstation status: partial notes: |- - The rule confirms the primary group for root, but doesn't check if any other user are also - using GID 0. New rule is necessary. There is assessment but no automated remediation for this rule and this sounds reasonable. rules: - accounts_root_gid_zero diff --git a/linux_os/guide/system/accounts/accounts-restrictions/root_logins/accounts_root_gid_zero/rule.yml b/linux_os/guide/system/accounts/accounts-restrictions/root_logins/accounts_root_gid_zero/rule.yml index efaa1dac9b2d..6fd443fff306 100644 --- a/linux_os/guide/system/accounts/accounts-restrictions/root_logins/accounts_root_gid_zero/rule.yml +++ b/linux_os/guide/system/accounts/accounts-restrictions/root_logins/accounts_root_gid_zero/rule.yml @@ -23,16 +23,16 @@ references: cis@sle15: 5.4.3 pcidss: Req-8.1.1 -ocil_clause: 'root has a primary gid not equal to zero' +ocil_clause: 'root has a primary gid not equal to zero or other non-system accounts has a primary gid equal to zero' ocil: |- To verify that root's primary group is zero run the following command:
-        grep '^root:' /etc/passwd | cut -d : -f 4
+        awk -F: '($1 !~ /^(sync|shutdown|halt|operator)/ && $4=="0") {print $1":"$4}' /etc/passwd
     
The command should return:
-    0
+        root:0
     
platform: system_with_kernel