Definition of 'files/directories'' with regard to permissions
Robert Sanders
rsanders at TrustedCS.com
Wed Nov 28 21:44:04 UTC 2012
>
> Files are not directories. Their permissions must be
> different because they have different meanings. I think its
> safe to say that if a file in /etc/skel needs to be world
> readable, then any subdirectory should be world readable and
> searchable.
>
> Steve
>
I agree with your take on the intent. I'd always been taught that 'everything' is a file in *nix, just that some files are more special than others :), using the higher order bits of the mode to indicate what kind of 'special'.
Looking at the benchmark I wasn't sure if the id used to collect the files in /etc/skel (oval:mil.disa.fso.rhel.obj:13300) distinguished bewteen regular files and directories. This same object is used for checking the owner/group restrictions as well as the permissions. GEN001820 (allowed user owners) explicitly calls out for checking directories, whereas GEN001830 (allowed group owner) just references the files themselves. I don't have a box up right now with the SCC checker running to see what happens to either man pages (except that I don't see GEN001280 in the benchmark) or if KDE is installed.
-Rob
More information about the scap-security-guide
mailing list