Definition of 'files/directories'' with regard to permissions

Steve Grubb sgrubb at redhat.com
Wed Nov 28 21:11:38 UTC 2012


On Wednesday, November 28, 2012 08:29:49 PM Robert Sanders wrote:
> Got a quick question for folks regarding whether a directory should be
> considered a 'file' when it comes down to setting permissions.  I'd asked
> this question in an email to the FSO and hadn't heard anything.  A good
> poster child for this is GEN001800 ["All skeleton files (typically those in
> /etc/skel) must have mode 0644 or less permissive" ].  If KDE is installed
> on this system then /etc/skel will hold a directory '.kde'.  If permissions
> on this directory are set to 0644 or less, and a new user is created, they
> will not be able to log in graphically using KDE.  The routine that created
> the users directory from the /etc/skel files copied the permissions
> exactly, just changed file ownership.  So the user if prevented from
> accessing their own $HOME/.kde directory.
> 
> Another example would be GEN001280 ["Manual page files must have mode 0644
> or less permissive"].  The U_Redhat_5-V1R1_STIG_Manual-xccdf.xml file
> (August 2012) references this, but I don't see it in the benchmark file.
> 
> For GEN001800 the permissions for subdirectories needs to be at least 0744,
> and for GEN001280 subdirectories need 0755.
> 
> If I'm being overly picky that is OK, I just would to know how others are
> interpreting these line items.

Files are not directories. Their permissions must be different because they 
have different meanings. I think its safe to say that if a file in /etc/skel 
needs to be world readable, then any subdirectory should be world readable and 
searchable.

Steve


More information about the scap-security-guide mailing list