diff --git a/linux_os/guide/system/software/integrity/software-integrity/rpm_verification/rpm_verify_permissions/oval/shared.xml b/linux_os/guide/system/software/integrity/software-integrity/rpm_verification/rpm_verify_permissions/oval/shared.xml index 66e3dea2032..6c73f41fbac 100644 --- a/linux_os/guide/system/software/integrity/software-integrity/rpm_verification/rpm_verify_permissions/oval/shared.xml +++ b/linux_os/guide/system/software/integrity/software-integrity/rpm_verification/rpm_verify_permissions/oval/shared.xml @@ -1,17 +1,20 @@ - - {{{ oval_metadata("Verify the permissions of installed packages - by comparing the installed files with information about the - files taken from the package metadata stored in the RPM - database.") }}} + + {{{ oval_metadata("Verify the permissions of installed packages by comparing the installed + files with information about the files taken from the package metadata stored in the RPM + database.") }}} - + - - - - + + + fail + + + .* .* @@ -19,9 +22,12 @@ .* .* .* - state_files_fail_mode + state_rpm_verify_permissions_files_fail_mode - - fail - + + + + diff --git a/linux_os/guide/system/software/integrity/software-integrity/rpm_verification/rpm_verify_permissions/rule.yml b/linux_os/guide/system/software/integrity/software-integrity/rpm_verification/rpm_verify_permissions/rule.yml index 5ba5ce1f030..ea6ff69f9bf 100644 --- a/linux_os/guide/system/software/integrity/software-integrity/rpm_verification/rpm_verify_permissions/rule.yml +++ b/linux_os/guide/system/software/integrity/software-integrity/rpm_verification/rpm_verify_permissions/rule.yml @@ -5,27 +5,24 @@ prodtype: alinux2,alinux3,anolis23,anolis8,fedora,ol7,ol8,ol9,rhcos4,rhel7,rhel8 title: 'Verify and Correct File Permissions with RPM' description: |- - The RPM package management system can check file access permissions - of installed software packages, including many that are important - to system security. - Verify that the file permissions of system files - and commands match vendor values. Check the file permissions - with the following command: + The RPM package management system can check file access permissions of installed software + packages, including many that are important to system security. Verify that the file + permissions of system files and commands match vendor values. Check the file permissions with + the following command:
$ sudo rpm -Va | awk '{ if (substr($0,2,1)=="M") print $NF }'
Output indicates files that do not match vendor defaults. - After locating a file with incorrect permissions, - run the following command to determine which package owns it: + + After locating a file with incorrect permissions, run the following command to determine which + package owns it:
$ rpm -qf FILENAME

- Next, run the following command to reset its permissions to - the correct values: + Next, run the following command to reset its permissions to the correct values:
$ sudo rpm --setperms PACKAGENAME
rationale: |- - Permissions on system binaries and configuration files that are too generous - could allow an unauthorized user to gain privileges that they should not have. - The permissions set by the vendor should be maintained. Any deviations from - this baseline should be investigated. + Permissions on system binaries and configuration files that are too generous could allow an + unauthorized user to gain privileges that they should not have. The permissions set by the + vendor should be maintained. Any deviations from this baseline should be investigated. severity: high @@ -74,7 +71,6 @@ fixtext: |- $ sudo rpm -qf [path to file] - Reset the permissions of files within a package with the following command: $ sudo rpm --setperms [package] @@ -83,7 +79,14 @@ srg_requirement: '{{{ full_name }}} must be configured so that the file permissi warnings: - general: |- - Profiles may require that specific files have stricter file permissions than defined by the - vendor. - Such files will be reported as a finding and need to be evaluated according to your policy - and deployment environment. + Profiles may require that specific files have stricter file permissions than defined by + the vendor. Such files will be reported as a finding and need to be evaluated according to + your policy and deployment environment. + - general: |- + This rule can take a long time to perform the check and might consume a considerable + amount of resources depending on the number of packages present on the system. It is not a + problem in most cases, but especially systems with a large number of installed packages + can be affected. + {{% if "rhel" in product %}} + See https://access.redhat.com/articles/6999111. + {{% endif %}}