[PATCH] Use mode 0 instead of 0400 for shadow and gshadow files

Shawn Wells shawn at redhat.com
Wed Sep 5 01:01:13 UTC 2012


On 9/4/12 8:50 PM, Kenneth Stailey wrote:
> From: "Kenneth Stailey" <kstailey.lists at gmail.com>
>
> RHEL6 distributions use mode 0 for the /etc/shadow and /etc/gshadow files.
>
> Signed-off-by: "Kenneth Stailey" <kstailey.lists at gmail.com>
> ---
>   .../input/checks/file_permissions_etc_gshadow.xml  |    2 +-
>   RHEL6/input/checks/file_permissions_etc_shadow.xml |    2 +-
>   2 files changed, 2 insertions(+), 2 deletions(-)
>
> diff --git a/RHEL6/input/checks/file_permissions_etc_gshadow.xml b/RHEL6/input/checks/file_permissions_etc_gshadow.xml
> index ee09d71..077459c 100644
> --- a/RHEL6/input/checks/file_permissions_etc_gshadow.xml
> +++ b/RHEL6/input/checks/file_permissions_etc_gshadow.xml
> @@ -22,7 +22,7 @@
>     </unix:file_test>
>     <unix:file_state id="state_1000400"
>     version="1">
> -    <unix:uread datatype="boolean">true</unix:uread>
> +    <unix:uread datatype="boolean">false</unix:uread>
>       <unix:uwrite datatype="boolean">false</unix:uwrite>
>       <unix:uexec datatype="boolean">false</unix:uexec>
>       <unix:gread datatype="boolean">false</unix:gread>
> diff --git a/RHEL6/input/checks/file_permissions_etc_shadow.xml b/RHEL6/input/checks/file_permissions_etc_shadow.xml
> index 4585ac2..d1e42ae 100644
> --- a/RHEL6/input/checks/file_permissions_etc_shadow.xml
> +++ b/RHEL6/input/checks/file_permissions_etc_shadow.xml
> @@ -22,7 +22,7 @@
>     </unix:file_test>
>     <unix:file_state id="state_1000401"
>     version="1">
> -    <unix:uread datatype="boolean">true</unix:uread>
> +    <unix:uread datatype="boolean">false</unix:uread>
>       <unix:uwrite datatype="boolean">false</unix:uwrite>
>       <unix:uexec datatype="boolean">false</unix:uexec>
>       <unix:gread datatype="boolean">false</unix:gread>

Ack. Please push or indicate you need someone to do so for you.

Thanks for doing this!


More information about the scap-security-guide mailing list