[PATCH 05/11] Updated prose of file_permissions_etc_passwd and mapped to CCI-000225

Shawn Wells shawn at redhat.com
Wed Jul 4 05:22:30 UTC 2012


This sections stated the file permissions needed to be secure, but did not provide a recomendation. Updated to state 0644 or less permissive, which is the RHEL default and matches the RHEL5 STIG requirements. Updated rational field as well. Mapped to CCI-000225.
---
 rhel6/src/input/system/permissions/files.xml |    9 +++++----
 1 files changed, 5 insertions(+), 4 deletions(-)

diff --git a/rhel6/src/input/system/permissions/files.xml b/rhel6/src/input/system/permissions/files.xml
index ce190b6..1bd75b1 100644
--- a/rhel6/src/input/system/permissions/files.xml
+++ b/rhel6/src/input/system/permissions/files.xml
@@ -144,12 +144,13 @@ the system. Protection of this file is critical for system security.</rationale>
 <Rule id="file_permissions_etc_passwd">
 <title>Verify permissions on <tt>passwd</tt> file</title>
 <description>File permissions for <tt>/etc/passwd</tt> should be set
-correctly.</description>
-<rationale>The /etc/passwd contains information about the users that are configured on
-the system. Protection of this file is critical for system security.</rationale>
+to 0644 or less permissive.</description>
+<rationale>If the passwd file is writable by a group-owner or the world the
+risk of passwd file compromise is increased. The passwd file contains the
+list of acounts on the system and associated information.</rational>
 <ident cce="3566-7" />
 <oval id="file_permissions_etc_passwd" />
-<ref nist="AC-3, CM-6"/>
+<ref nist="AC-3, CM-6" disa="225"/>
 </Rule>
 </Group>
 
-- 
1.7.1


--tThc/1wpZn/ma/RB--


More information about the scap-security-guide mailing list