From shawn at redhat.com Thu Aug 20 11:37:25 2015 Content-Type: multipart/mixed; boundary="===============4161825049930803473==" MIME-Version: 1.0 From: Shawn Wells To: scap-security-guide at lists.fedorahosted.org Subject: Re: [PATCH 08/21] [bugfix] Modify file_permissions_binary_dirs to follow symlinks Date: Sun, 27 Jul 2014 23:36:13 -0400 Message-ID: <53D5C52D.10706@redhat.com> In-Reply-To: 1406518028-3921-9-git-send-email-shawn@redhat.com --===============4161825049930803473== Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable On 7/27/14, 11:26 PM, Shawn Wells wrote: > From: Leland Steinke > > > Signed-off-by: Leland Steinke > --- > RHEL/6/input/auxiliary/stig_overlay.xml | 2 +- > RHEL/6/input/system/permissions/files.xml | 2 +- > 2 files changed, 2 insertions(+), 2 deletions(-) > > diff --git a/RHEL/6/input/auxiliary/stig_overlay.xml b/RHEL/6/input/auxil= iary/stig_overlay.xml > index 84515ab..d9820bc 100644 > --- a/RHEL/6/input/auxiliary/stig_overlay.xml > +++ b/RHEL/6/input/auxiliary/stig_overlay.xml > @@ -153,7 +153,7 @@ > Library files must be owned by root. > > > - > + > All system command files must have mode 0755 or less permissiv= e. > > > diff --git a/RHEL/6/input/system/permissions/files.xml b/RHEL/6/input/sys= tem/permissions/files.xml > index e2883f3..5762fd9 100644 > --- a/RHEL/6/input/system/permissions/files.xml > +++ b/RHEL/6/input/system/permissions/files.xml > @@ -285,7 +285,7 @@ System executables are stored in the following direct= ories by default: > /usr/local/sbin > To find system executables that are group-writable or world-writable, > run the following command for each directory DIR which contains = system executables: > -
$ find DIR -perm /022
> +
$ find -L DIR -perm /022 -type f
> > System binaries are executed by privileged users, as well as= system services, > and restrictive permissions are necessary to ensure execution of these = programs > -- 1.7.1 ack --===============4161825049930803473== Content-Type: text/html MIME-Version: 1.0 Content-Transfer-Encoding: base64 Content-Disposition: attachment; filename="attachment.html" PGh0bWw+CiAgPGhlYWQ+CiAgICA8bWV0YSBjb250ZW50PSJ0ZXh0L2h0bWw7IGNoYXJzZXQ9VVRG LTgiIGh0dHAtZXF1aXY9IkNvbnRlbnQtVHlwZSI+CiAgPC9oZWFkPgogIDxib2R5IGJnY29sb3I9 IiNGRkZGRkYiIHRleHQ9IiMwMDAwMDAiPgogICAgPGJyPgogICAgPGRpdiBjbGFzcz0ibW96LWNp dGUtcHJlZml4Ij5PbiA3LzI3LzE0LCAxMToyNiBQTSwgU2hhd24gV2VsbHMKICAgICAgd3JvdGU6 PGJyPgogICAgPC9kaXY+CiAgICA8YmxvY2txdW90ZQogICAgICBjaXRlPSJtaWQ6MTQwNjUxODAy OC0zOTIxLTktZ2l0LXNlbmQtZW1haWwtc2hhd25AcmVkaGF0LmNvbSIKICAgICAgdHlwZT0iY2l0 ZSI+CiAgICAgIDxkaXYgY2xhc3M9Im1vei10ZXh0LXBsYWluIiB3cmFwPSJ0cnVlIiBncmFwaGlj YWwtcXVvdGU9InRydWUiCiAgICAgICAgc3R5bGU9ImZvbnQtZmFtaWx5OiAtbW96LWZpeGVkOyBm b250LXNpemU6IDEycHg7IgogICAgICAgIGxhbmc9IngtdW5pY29kZSI+CiAgICAgICAgPHByZSB3 cmFwPSIiPkZyb206IExlbGFuZCBTdGVpbmtlIDxhIG1vei1kby1ub3Qtc2VuZD0idHJ1ZSIgY2xh c3M9Im1vei10eHQtbGluay1yZmMyMzk2RSIgaHJlZj0ibWFpbHRvOmxlbGFuZC5qLnN0ZWlua2Uu Y3RyQG1haWwubWlsIj4mbHQ7bGVsYW5kLmouc3RlaW5rZS5jdHJAbWFpbC5taWwmZ3Q7PC9hPgoK ClNpZ25lZC1vZmYtYnk6IExlbGFuZCBTdGVpbmtlIDxhIG1vei1kby1ub3Qtc2VuZD0idHJ1ZSIg Y2xhc3M9Im1vei10eHQtbGluay1yZmMyMzk2RSIgaHJlZj0ibWFpbHRvOmxlbGFuZC5qLnN0ZWlu a2UuY3RyQG1haWwubWlsIj4mbHQ7bGVsYW5kLmouc3RlaW5rZS5jdHJAbWFpbC5taWwmZ3Q7PC9h PgotLS0KIFJIRUwvNi9pbnB1dC9hdXhpbGlhcnkvc3RpZ19vdmVybGF5LnhtbCAgIHwgICAgMiAr LQogUkhFTC82L2lucHV0L3N5c3RlbS9wZXJtaXNzaW9ucy9maWxlcy54bWwgfCAgICAyICstCiAy IGZpbGVzIGNoYW5nZWQsIDIgaW5zZXJ0aW9ucygrKSwgMiBkZWxldGlvbnMoLSkKCmRpZmYgLS1n aXQgYS9SSEVMLzYvaW5wdXQvYXV4aWxpYXJ5L3N0aWdfb3ZlcmxheS54bWwgYi9SSEVMLzYvaW5w dXQvYXV4aWxpYXJ5L3N0aWdfb3ZlcmxheS54bWwKaW5kZXggODQ1MTVhYi4uZDk4MjBiYyAxMDA2 NDQKLS0tIGEvUkhFTC82L2lucHV0L2F1eGlsaWFyeS9zdGlnX292ZXJsYXkueG1sCisrKyBiL1JI RUwvNi9pbnB1dC9hdXhpbGlhcnkvc3RpZ19vdmVybGF5LnhtbApAQCAtMTUzLDcgKzE1Myw3IEBA CiAJCSZsdDt0aXRsZSZndDtMaWJyYXJ5IGZpbGVzIG11c3QgYmUgb3duZWQgYnkgcm9vdC4mbHQ7 L3RpdGxlJmd0OwogCSZsdDsvb3ZlcmxheSZndDsKIAkmbHQ7b3ZlcmxheSBvd25lcj0iZGlzYXN0 aWciIHJ1bGVpZD0iZmlsZV9wZXJtaXNzaW9uc19iaW5hcnlfZGlycyIgb3duZXJpZD0iUkhFTC0w Ni0wMDAwNDciIGRpc2E9IjE0OTkiIHNldmVyaXR5PSJtZWRpdW0iJmd0OwotCQkmbHQ7Vk1TaW5m byBWS2V5PSIzODQ2OSIgU1ZLZXk9IjUwMjY5IiBWUmVsZWFzZT0iMSIgLyZndDsKKwkJJmx0O1ZN U2luZm8gVktleT0iMzg0NjkiIFNWS2V5PSI1MDI2OSIgVlJlbGVhc2U9IjIiIC8mZ3Q7CiAJCSZs dDt0aXRsZSZndDtBbGwgc3lzdGVtIGNvbW1hbmQgZmlsZXMgbXVzdCBoYXZlIG1vZGUgMDc1NSBv ciBsZXNzIHBlcm1pc3NpdmUuJmx0Oy90aXRsZSZndDsKIAkmbHQ7L292ZXJsYXkmZ3Q7CiAJJmx0 O292ZXJsYXkgb3duZXI9ImRpc2FzdGlnIiBydWxlaWQ9ImZpbGVfb3duZXJzaGlwX2JpbmFyeV9k aXJzIiBvd25lcmlkPSJSSEVMLTA2LTAwMDA0OCIgZGlzYT0iMTQ5OSIgc2V2ZXJpdHk9Im1lZGl1 bSImZ3Q7CmRpZmYgLS1naXQgYS9SSEVMLzYvaW5wdXQvc3lzdGVtL3Blcm1pc3Npb25zL2ZpbGVz LnhtbCBiL1JIRUwvNi9pbnB1dC9zeXN0ZW0vcGVybWlzc2lvbnMvZmlsZXMueG1sCmluZGV4IGUy ODgzZjMuLjU3NjJmZDkgMTAwNjQ0Ci0tLSBhL1JIRUwvNi9pbnB1dC9zeXN0ZW0vcGVybWlzc2lv bnMvZmlsZXMueG1sCisrKyBiL1JIRUwvNi9pbnB1dC9zeXN0ZW0vcGVybWlzc2lvbnMvZmlsZXMu eG1sCkBAIC0yODUsNyArMjg1LDcgQEAgU3lzdGVtIGV4ZWN1dGFibGVzIGFyZSBzdG9yZWQgaW4g dGhlIGZvbGxvd2luZyBkaXJlY3RvcmllcyBieSBkZWZhdWx0OgogL3Vzci9sb2NhbC9zYmluJmx0 Oy9wcmUmZ3Q7CiBUbyBmaW5kIHN5c3RlbSBleGVjdXRhYmxlcyB0aGF0IGFyZSBncm91cC13cml0 YWJsZSBvciB3b3JsZC13cml0YWJsZSwKIHJ1biB0aGUgZm9sbG93aW5nIGNvbW1hbmQgZm9yIGVh Y2ggZGlyZWN0b3J5ICZsdDtpJmd0O0RJUiZsdDsvaSZndDsgd2hpY2ggY29udGFpbnMgc3lzdGVt IGV4ZWN1dGFibGVzOgotJmx0O3ByZSZndDskIGZpbmQgJmx0O2kmZ3Q7RElSJmx0Oy9pJmd0OyAt cGVybSAvMDIyJmx0Oy9wcmUmZ3Q7CismbHQ7cHJlJmd0OyQgZmluZCAtTCAmbHQ7aSZndDtESVIm bHQ7L2kmZ3Q7IC1wZXJtIC8wMjIgLXR5cGUgZiZsdDsvcHJlJmd0OwogJmx0Oy9vY2lsJmd0Owog Jmx0O3JhdGlvbmFsZSZndDtTeXN0ZW0gYmluYXJpZXMgYXJlIGV4ZWN1dGVkIGJ5IHByaXZpbGVn ZWQgdXNlcnMsIGFzIHdlbGwgYXMgc3lzdGVtIHNlcnZpY2VzLAogYW5kIHJlc3RyaWN0aXZlIHBl cm1pc3Npb25zIGFyZSBuZWNlc3NhcnkgdG8gZW5zdXJlIGV4ZWN1dGlvbiBvZiB0aGVzZSBwcm9n cmFtcwo8ZGl2IGNsYXNzPSJtb3otdHh0LXNpZyI+LS0gCjEuNy4xCjwvZGl2PjwvcHJlPgogICAg ICA8L2Rpdj4KICAgIDwvYmxvY2txdW90ZT4KICAgIDxicj4KICAgIGFjazxicj4KICA8L2JvZHk+ CjwvaHRtbD4K --===============4161825049930803473==--