On Wednesday, November 28, 2012 08:29:49 PM Robert Sanders wrote:
Got a quick question for folks regarding whether a directory should
be
considered a 'file' when it comes down to setting permissions. I'd asked
this question in an email to the FSO and hadn't heard anything. A good
poster child for this is GEN001800 ["All skeleton files (typically those in
/etc/skel) must have mode 0644 or less permissive" ]. If KDE is installed
on this system then /etc/skel will hold a directory '.kde'. If permissions
on this directory are set to 0644 or less, and a new user is created, they
will not be able to log in graphically using KDE. The routine that created
the users directory from the /etc/skel files copied the permissions
exactly, just changed file ownership. So the user if prevented from
accessing their own $HOME/.kde directory.
Another example would be GEN001280 ["Manual page files must have mode 0644
or less permissive"]. The U_Redhat_5-V1R1_STIG_Manual-xccdf.xml file
(August 2012) references this, but I don't see it in the benchmark file.
For GEN001800 the permissions for subdirectories needs to be at least 0744,
and for GEN001280 subdirectories need 0755.
If I'm being overly picky that is OK, I just would to know how others are
interpreting these line items.
Files are not directories. Their permissions must be different because they
have different meanings. I think its safe to say that if a file in /etc/skel
needs to be world readable, then any subdirectory should be world readable and
searchable.
Steve