[PATCH ] [RHEL/6] search for libraries would find items outsite /lib /lib64 /usr/lib and /usr/lib64

Shawn Wells shawn at redhat.com
Tue Apr 22 17:30:27 UTC 2014


On 4/22/14, 12:46 PM, Steve Grubb wrote:
> On Tuesday, April 22, 2014 11:16:31 AM Renshaw, Richard /c wrote:
>> >Jan,
>> >Without the trailing / the regex will match any directory starting with
>> >/lib, /lib64, /usr/lib, or /usr/lib64.  Like the spurious /usr/libexec/
>> >file I was running into. Even if the trailing / isn't the correct fix,
>> >something needs to be changed to fix the regex.
> libexec is for executables that should not be called directly. I think files in
> that directory should be checked following the same rules as /(s)bin or
> /usr/(s)bin. The library checks should apply to /lib(64), /usr/lib(64) and
> possibly /usr/local/lib(64). I think in both cases it should be recursive,
> just in case.

Could we use an SSG rule (which, eventually, would be STIG and USGCB) to 
drive RHEL packaging RFEs?

As stands, /usr/libexec/abrt-action-install-debuginfo-to-abrt-cache via 
the brt-addon-ccpp package ships as abrt:abrt. We'd need big RHT to 
alter default permissions to meet the adjusted rules you recommended.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.fedorahosted.org/pipermail/scap-security-guide/attachments/20140422/bcde3d8c/attachment.html>


More information about the scap-security-guide mailing list