<html>
  <head>
    <meta content="text/html; charset=UTF-8" http-equiv="Content-Type">
  </head>
  <body bgcolor="#FFFFFF" text="#000000">
    <br>
    <div class="moz-cite-prefix">On 4/3/14, 6:27 AM, Jan Lieskovsky
      wrote:<br>
    </div>
    <blockquote
      cite="mid:1312228722.12405842.1396524427459.JavaMail.zimbra@redhat.com"
      type="cite">
      <div class="moz-text-plain" wrap="true" graphical-quote="true"
        style="font-family: -moz-fixed; font-size: 12px;"
        lang="x-unicode">
        <pre wrap="">When checking "Verify /boot/grub/grub.conf Permissions" rule,
allow the check to succeed also in case the underlying system
has stronger file permissions on /boot/grub/grub.conf file
than exactly 0600 (IOW instead of exact requirement of / for 0600
permissions, make the 0600 mode the upper bound of the allowed
value / range).

Please review.

Thank you &amp;&amp; Regards, Jan.
--
Jan iankko Lieskovsky / Red Hat Security Technologies Team</pre>
      </div>
      <br>
      <fieldset class="mimeAttachmentHeader"><legend
          class="mimeAttachmentHeaderName">0001-RHEL-6-Allow-boot-grub-grub.conf-permissions-to-be-s.patch</legend></fieldset>
      <br>
      <div class="moz-text-plain" wrap="true" graphical-quote="true"
        style="font-family: -moz-fixed; font-size: 12px;"
        lang="x-western">
        <pre wrap="">From 1203661223621428e00271a236432540cde59ff6 Mon Sep 17 00:00:00 2001
From: Jan Lieskovsky <a moz-do-not-send="true" class="moz-txt-link-rfc2396E" href="mailto:jlieskov@redhat.com">&lt;jlieskov@redhat.com&gt;</a>
Date: Thu, 3 Apr 2014 13:17:34 +0200
Subject: [PATCH] [RHEL/6] Allow /boot/grub/grub.conf permissions to be
 stronger than 0600

Signed-off-by: Jan Lieskovsky <a moz-do-not-send="true" class="moz-txt-link-rfc2396E" href="mailto:jlieskov@redhat.com">&lt;jlieskov@redhat.com&gt;</a>
---
 RHEL/6/input/checks/file_permissions_grub_conf.xml | 8 +++-----
 1 file changed, 3 insertions(+), 5 deletions(-)

diff --git a/RHEL/6/input/checks/file_permissions_grub_conf.xml b/RHEL/6/input/checks/file_permissions_grub_conf.xml
index 747f2d9..3347a8b 100644
--- a/RHEL/6/input/checks/file_permissions_grub_conf.xml
+++ b/RHEL/6/input/checks/file_permissions_grub_conf.xml
@@ -1,11 +1,11 @@
 &lt;def-group&gt;
-  &lt;definition class="compliance" id="file_permissions_grub_conf" version="1"&gt;
+  &lt;definition class="compliance" id="file_permissions_grub_conf" version="2"&gt;
     &lt;metadata&gt;
       &lt;title&gt;File /boot/grub/grub.conf Permissions&lt;/title&gt;
       &lt;affected family="unix"&gt;
         &lt;platform&gt;Red Hat Enterprise Linux 6&lt;/platform&gt;
       &lt;/affected&gt;
-      &lt;description&gt;File permissions for /boot/grub/grub.conf should be set to 0600.&lt;/description&gt;
+      &lt;description&gt;File permissions for /boot/grub/grub.conf should be set to 0600 (or stronger).&lt;/description&gt;
     &lt;/metadata&gt;
     &lt;criteria&gt;
       &lt;criterion test_ref="test_file_permissions_grub_conf" /&gt;
@@ -22,9 +22,7 @@
     &lt;unix:filename&gt;grub.conf&lt;/unix:filename&gt;
   &lt;/unix:file_object&gt;
 
-  &lt;unix:file_state id="state_file_permissions_grub_conf" version="1"&gt;
-    &lt;unix:uread datatype="boolean"&gt;true&lt;/unix:uread&gt;
-    &lt;unix:uwrite datatype="boolean"&gt;true&lt;/unix:uwrite&gt;
+  &lt;unix:file_state id="state_file_permissions_grub_conf" version="2"&gt;
     &lt;unix:uexec datatype="boolean"&gt;false&lt;/unix:uexec&gt;
     &lt;unix:gread datatype="boolean"&gt;false&lt;/unix:gread&gt;
     &lt;unix:gwrite datatype="boolean"&gt;false&lt;/unix:gwrite&gt;
<div class="moz-txt-sig">-- 
1.8.3.1

</div></pre>
      </div>
    </blockquote>
    <br>
    <br>
    This seems to be another patch that slipped through the cracks
    (GitHub, here we come....).<br>
    <br>
    Perfectly sane - ack<br>
  </body>
</html>