On 4/22/14, 12:46 PM, Steve Grubb wrote:
On Tuesday, April 22, 2014 11:16:31 AM Renshaw, Richard /c wrote:
> Jan, 
> Without the trailing / the regex will match any directory starting with
> /lib, /lib64, /usr/lib, or /usr/lib64.  Like the spurious /usr/libexec/
> file I was running into. Even if the trailing / isn't the correct fix,
> something needs to be changed to fix the regex. 
libexec is for executables that should not be called directly. I think files in 
that directory should be checked following the same rules as /(s)bin or 
/usr/(s)bin. The library checks should apply to /lib(64), /usr/lib(64) and 
possibly /usr/local/lib(64). I think in both cases it should be recursive, 
just in case.

Could we use an SSG rule (which, eventually, would be STIG and USGCB) to drive RHEL packaging RFEs?

As stands, /usr/libexec/abrt-action-install-debuginfo-to-abrt-cache via the brt-addon-ccpp package ships as abrt:abrt. We'd need big RHT to alter default permissions to meet the adjusted rules you recommended.