>From 0ea406bcdf0e400b44047de06f991c32e3a3875e Mon Sep 17 00:00:00 2001 From: Shawn Wells Date: Mon, 3 Dec 2012 19:43:34 -0500 Subject: [PATCH 2/2] DISA FSO requested updates to RHEL6/input/system/permissions/files.xml DISA FSO requested updates to RHEL6/input/system/permissions/files.xml Closing ticke https://fedorahosted.org/scap-security-guide/ticket/157 --- RHEL6/input/system/permissions/files.xml | 34 ++++++++++++----------------- 1 files changed, 14 insertions(+), 20 deletions(-) diff --git a/RHEL6/input/system/permissions/files.xml b/RHEL6/input/system/permissions/files.xml index 14b6fcb..e714982 100644 --- a/RHEL6/input/system/permissions/files.xml +++ b/RHEL6/input/system/permissions/files.xml @@ -193,13 +193,10 @@ by default: /usr/lib64 Kernel modules, which can be added to the kernel during runtime, are -stored in: -
/lib/modules
-All files in these directories should not be -group-writable or world-writable. -If any file FILE in these directories is found -to be group-writable or world-writeable, correct its permission with the -following command: +stored in /lib/modules>. All files in these directories +should not be group-writable or world-writable. If any file in these +directories is found to be group-writable or world-writeable, correct +its permission with the following command:
# chmod go-w FILE
@@ -226,16 +223,13 @@ by default: /usr/lib64 Kernel modules, which can be added to the kernel during runtime, are also -stored in: -
/lib/modules
-All files in these directories should be -owned by the root user. -If any file FILE in these directories is found +stored in /lib/modules. All files in these directories should be +owned by the root user. If any file in these directories is found to be owned by a user other than root, correct its ownership with the following command:
# chown root FILE
- + To find shared libraries that are not owned by root, run the following command for each directory DIR which contains shared libraries:
$ find DIR \! -user root
@@ -264,14 +258,14 @@ to be group-writable or world-writeable, correct its permission with the following command:
# chmod go-w FILE
- + To find system executables that are group-writable or world-writable, run the following command for each directory DIR which contains system executables:
$ find DIR -perm /022
-System binaries are executed by privileged users as well as system services, -and restrictive permissions are necessary to ensure that their -execution of these programs cannot be co-opted. +System binaries are executed by privileged users, as well as system services, +and restrictive permissions are necessary to ensure execution of these programs +cannot be co-opted. @@ -414,7 +408,7 @@ cause of their lack of ownership should be investigated. Following this, the files should be deleted or assigned to an appropriate user. - + The following command will discover and print any files on local partitions which do not belong to a valid user. Run it once for each local partition PART: @@ -425,7 +419,7 @@ Unowned files do not directly imply a security problem, but they are generally a sign that something is amiss. They may be caused by an intruder, by incorrect software installation or draft software removal, or by failure to remove all files belonging -to a deleted account. The files should be repaired so that they +to a deleted account. The files should be repaired so they will not cause problems when accounts are created in the future, and the cause should be discovered and addressed. @@ -452,7 +446,7 @@ Unowned files do not directly imply a security problem, but they are generally a sign that something is amiss. They may be caused by an intruder, by incorrect software installation or draft software removal, or by failure to remove all files belonging -to a deleted account. The files should be repaired so that they +to a deleted account. The files should be repaired so they will not cause problems when accounts are created in the future, and the cause should be discovered and addressed. -- 1.7.1