Servers – Ensure Root PATH Integrity

Support > Fixing Checks > Server

06 March, 2026

This check ensures that the root user's PATH variable is configured securely. The PATH environment variable determines the directories the system searches when executing commands.

If insecure directories such as the current directory (.) or writable directories are included in the root user's PATH, an attacker could place a malicious program that may be executed unintentionally by the administrator. Maintaining a secure PATH helps prevent unauthorized privilege escalation.

Check Details

Resource: Server
Check: Ensure Root Path Integrity
Risk: If the root PATH includes insecure or writable directories, an attacker may place malicious executables that could be run unintentionally by the root user, leading to full system compromise.

Remediation Steps

Open a terminal session on the server with root or sudo privileges.
Check the current PATH configuration for the root user.
```
sudo -Hiu root env | grep '^PATH'
```
Verify that the PATH variable does not contain:
- Empty directory entries (::)
- A trailing colon (:)
- The current directory (.)
- Directories that are writable by group or others

Run the following script to identify insecure directories within the root PATH.

#!/bin/bash

PATH="$(sudo -Hiu root env | grep '^PATH' | cut -d= -f2)"

echo "$PATH" | grep -q "::" && echo "Empty directory in PATH (::)"
echo "$PATH" | grep -q ":$" && echo "Trailing : in PATH"

for dir in $(echo "$PATH" | tr ":" " "); do
if [ -d "$dir" ]; then
ls -ldH "$dir" | awk '
        substr($1,6,1) != "-" { print $9, "is group writable" }
        substr($1,9,1) != "-" { print $9, "is world writable" }
        $3 != "root"        { print $9, "is not owned by root" }
        '
    else
        echo "$dir is not a directory"
fi
done

If any insecure directories are identified, update permissions or remove them from the root PATH configuration files such as /root/.bashrc, /root/.profile, or system-wide environment files.
Ensure that all directories in the root PATH are:
- Owned by root
- Not writable by group or other users
- Valid directories required for system administration

Other Articles

Servers – Ensure Root PATH Integrity

Check Details

Remediation Steps