Questions about rpm verification

Shawn Wells shawn at redhat.com
Thu Jul 18 02:56:10 UTC 2013


On 7/9/13 10:56 AM, Robert Sanders wrote:
> For items RHEL-06-000278 and 518, should the 'ls -lL' command in the 
> manual document be 'ls -lLd' instead, so that you look at the 
> permissions/ownership of any directories themselves rather than drill 
> down into them?  Apologies if this has been mentioned/discussed already.
I see what you mean:
[root at rhel6 shawn]# rpm -V audit | grep '^.M'
.M.......    /usr/lib64/audit
[root at rhel6 shawn]# rpm -q --queryformat "[%{FILENAMES} 
%{FILEMODES:perms}\n]" audit | grep /usr/lib64/audit
/usr/lib64/audit drwxr-x---
[root at rhel6 shawn]# ls -lL /usr/lib64/audit/
total 0
[root at rhel6 shawn]# ls -lLd /usr/lib64/audit/
drwxr-xr-x. 2 root root 4096 Mar 14  2012 /usr/lib64/audit/

So yes, a patch around "if this is a directory, use -lLd" would be great!


More information about the scap-security-guide mailing list