[PATCH 1/3] M1 Incomplete Guidance - Proxy

Jeffrey Blank blank at eclipse.ncsc.mil
Wed Apr 11 18:29:36 UTC 2012


> I think the question is more one of how much does this really enhance
> the security.  In some cases such as where permissions were changed from
> the default, they provided little to no real value and merely hampered
> things like rpm -V.  If the security provided is significant I think we
> can all agree its worth the pain.


Well, yes.  This is largely about use-case / role of the system.  There
may even be difference between whether we expect hashes to agree or
simply for permissions to agree (comprehensively via rpm).

Here is some of my perspective on the matter.
There are very few files on RHEL where tighter-than-default permissions
provide value, and Red Hat has historically been receptive to tightening
such permissions (when we've asked and also had a sane case for doing
so).  Every once in a blue moon something might get packaged with goofy
permissions, but that's what bugzilla is for, and not something you'd
ask every admin to check for all the time.  (In fact, the checks against
certain directories or the whole filesystem are what tends to reveal any
such oddities, so I strongly support these.)

This is a good topic for a future discussion or documentation on the
wiki as a matter of establishing a common perspective.  As I mentioned,
I believe there is good value in global or directory-wide permissions
checks (especially when they are linked to a requirements for files of a
certain class).  However, the only files that I believe should be called
out for inspection on an individual basis are those which contain
account or credential information (or are otherwise singularly
important, such as those which control boot parameters).  If any other
files are to be called out for individual inspection from the 200,000 or
so files on the system (which are all important, and arguably equally
so), there must be some kind of criteria similar to those I've just
mentioned.  I do not want a body of guidance that is 30% a random
selection of file permissions checks based on no particular criteria.

To Spencer's point (with which I also agree), we are trying to satisfy
two use cases.  For general-purpose systems I think it's a reasonable
expectation that rpm -V complete successfully.  For specialized systems
that are fulfilling roles with particular security requirements,
integrity checking may depend more strongly on aide or strong change
controls, and it's probably not reasonable to expect rpm verification
(of hashes) to succeed.

Always in my mind is concern about creation of baselines that draws from
configurations designed for a specialized system and tries to apply them
to a general purpose system and creates senseless misery.  However,
careful consideration of a system's role when creating Profiles should
help address this.


More information about the scap-security-guide mailing list