diff --git a/linux_os/guide/system/software/integrity/software-integrity/rpm_verification/rpm_verify_permissions/oval/shared.xml b/linux_os/guide/system/software/integrity/software-integrity/rpm_verification/rpm_verify_permissions/oval/shared.xml
index 66e3dea2032..6c73f41fbac 100644
--- a/linux_os/guide/system/software/integrity/software-integrity/rpm_verification/rpm_verify_permissions/oval/shared.xml
+++ b/linux_os/guide/system/software/integrity/software-integrity/rpm_verification/rpm_verify_permissions/oval/shared.xml
@@ -1,17 +1,20 @@
$ sudo rpm -Va | awk '{ if (substr($0,2,1)=="M") print $NF }'Output indicates files that do not match vendor defaults. - After locating a file with incorrect permissions, - run the following command to determine which package owns it: + + After locating a file with incorrect permissions, run the following command to determine which + package owns it:
$ rpm -qf FILENAME
$ sudo rpm --setperms PACKAGENAMErationale: |- - Permissions on system binaries and configuration files that are too generous - could allow an unauthorized user to gain privileges that they should not have. - The permissions set by the vendor should be maintained. Any deviations from - this baseline should be investigated. + Permissions on system binaries and configuration files that are too generous could allow an + unauthorized user to gain privileges that they should not have. The permissions set by the + vendor should be maintained. Any deviations from this baseline should be investigated. severity: high @@ -74,7 +71,6 @@ fixtext: |- $ sudo rpm -qf [path to file] - Reset the permissions of files within a package with the following command: $ sudo rpm --setperms [package] @@ -83,7 +79,14 @@ srg_requirement: '{{{ full_name }}} must be configured so that the file permissi warnings: - general: |- - Profiles may require that specific files have stricter file permissions than defined by the - vendor. - Such files will be reported as a finding and need to be evaluated according to your policy - and deployment environment. + Profiles may require that specific files have stricter file permissions than defined by + the vendor. Such files will be reported as a finding and need to be evaluated according to + your policy and deployment environment. + - general: |- + This rule can take a long time to perform the check and might consume a considerable + amount of resources depending on the number of packages present on the system. It is not a + problem in most cases, but especially systems with a large number of installed packages + can be affected. + {{% if "rhel" in product %}} + See
https://access.redhat.com/articles/6999111
.
+ {{% endif %}}