[PATCH] [shared] When checking permissions on /etc/group and /etc/passwd allow also stronger permissions than just exactly 0644

Trevor Vaughan tvaughan at onyxpoint.com
Wed Apr 9 00:45:05 UTC 2014


I thought that, functionally, /etc/passwd and gorup needed to be 0644 for
most applications to function correctly. Things may have changed since the
last time I tried it but I seem to remember PAM not being able to find my
home directory when I tried to do this once before.

I guess this might not be the case if you put all of your uses in LDAP but
then what does it matter that the files are world readable?

Thanks,

Trevor


On Thu, Apr 3, 2014 at 8:26 AM, Jan Lieskovsky <jlieskov at redhat.com> wrote:

>
> [shared] When checking permissions on /etc/group and /etc/passwd files,
> don't require exactly 0644 mode, but allow also systems having
> stronger file permissions on these files to meet the tests (IOW make
> 0644 mode the minimal safe requirement).
>
> Please review.
>
> Thank you && Regards, Jan
> --
> Jan iankko Lieskovsky / Red Hat Security Technologies Team
> _______________________________________________
> scap-security-guide mailing list
> scap-security-guide at lists.fedorahosted.org
> https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide
>
>


-- 
Trevor Vaughan
Vice President, Onyx Point, Inc
(410) 541-6699
tvaughan at onyxpoint.com

-- This account not approved for unencrypted proprietary information --
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.fedorahosted.org/pipermail/scap-security-guide/attachments/20140408/7b81b81a/attachment.html>


More information about the scap-security-guide mailing list