Questions about rpm verification
Robert Sanders
rsanders at TrustedCS.com
Mon Jul 8 21:50:32 UTC 2013
Wunnerful... The /var/log/gdm issue is because the spec file has /var/log/gdm as a directory with 755 owned by root:root, but it looks like the executable is 'adjusting' this to be 770 (plus sticky, so 1770) with root:gdm. Ignoring the sticky bit, 770 is more permissive than 755 (group write). Stickybit I would submit is more secure than not, and perhaps SGID, but not SUID. Thoughts?
-Rob
________________________________
From: Robert Sanders
Sent: Monday, July 08, 2013 4:15 PM
To: scap-security-guide at lists.fedorahosted.org
Subject: Questions about rpm verification
Greeting everyone,
Just had some questions related to the rpm verification items in the RHEL6 STIG.
1) How are people handling 3rd party software that isn't installed from a yum repo?
2) On my RHEL6.4 VM I ran an 'rpm -Va' right after I installed the system, and received the following output:
S.5....T. c /etc/maven/maven2-depmap.xml
..5....T. /usr/share/ibus-table/tables/compose.db
..5....T. /usr/share/ibus-table/tables/latex.db
SM5....T. c /etc/sysconfig/rhn/up2date
.M....G.. /var/log/gdm
.M....... /var/run/gdm
missing /var/run/gdm/greeter
..5....T. c /usr/lib/security/classpath.security
..5....T. c /etc/inittab
S.5....T. /usr/share/texmf/web2c/updmap.cfg
....L.... c /etc/pam.d/fingerprint-auth
....L.... c /etc/pam.d/password-auth
....L.... c /etc/pam.d/smartcard-auth
....L.... c /etc/pam.d/system-auth
S.5....T. c /etc/rsyslog.conf
So this shows there are 6 'issues' to be dealt with since we can ignore the config issues (c). Most of these are non-issues so far as I can see, due to files being rebuilt/tweaked during install or known transient files, and could be avoided if the owning rpms labeled the files as configuration files perhaps.
-Rob
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.fedorahosted.org/pipermail/scap-security-guide/attachments/20130708/7b7ee260/attachment.html>
More information about the scap-security-guide
mailing list