[PATCH] Use mode 0 for gshadow file

Jeffrey Blank blank at eclipse.ncsc.mil
Wed Sep 5 20:40:11 UTC 2012


good to chat with you -- as we discussed, let's try updating the
checks/templates/file_dir_permissions templates file for this (and for
future file permission checks). (and then commit changes from the
template list and also the resultant OVAL.)



On 09/05/2012 12:39 PM, kstailey.lists at gmail.com wrote:
> From: Kenneth Stailey <kstailey.lists at gmail.com>
> 
> By using mode 0 for the /etc/gshadow file we avoid switching
> to a less restrictive protection mode and avoid having the
> file permissions to deviate from the permissions recorded
> in the RPM database.
> 
> Signed-off-by: Kenneth Stailey <kstailey.lists at gmail.com>
> ---
>  .../input/checks/file_permissions_etc_gshadow.xml  |    4 ++--
>  1 files changed, 2 insertions(+), 2 deletions(-)
> 
> diff --git a/RHEL6/input/checks/file_permissions_etc_gshadow.xml b/RHEL6/input/checks/file_permissions_etc_gshadow.xml
> index d86a582..674f7bc 100644
> --- a/RHEL6/input/checks/file_permissions_etc_gshadow.xml
> +++ b/RHEL6/input/checks/file_permissions_etc_gshadow.xml
> @@ -19,9 +19,9 @@
>      <unix:object object_ref="obj_20038" />
>      <unix:state state_ref="state_1000400" />
>    </unix:file_test>
> -  <unix:file_state id="state_1000400"
> +  <unix:file_state id="state_1000000"
>    version="1">
> -    <unix:uread datatype="boolean">true</unix:uread>
> +    <unix:uread datatype="boolean">false</unix:uread>
>      <unix:uwrite datatype="boolean">false</unix:uwrite>
>      <unix:uexec datatype="boolean">false</unix:uexec>
>      <unix:gread datatype="boolean">false</unix:gread>


More information about the scap-security-guide mailing list