Check: RHEL-07-010010
Red Hat Enterprise Linux 7 STIG:
RHEL-07-010010
(in versions v3 r14 through v3 r10)
Title
The Red Hat Enterprise Linux operating system must be configured so that the file permissions, ownership, and group membership of system files and commands match the vendor values. (Cat I impact)
Discussion
Discretionary access control is weakened if a user or group has access permissions to system files and directories greater than the default. Satisfies: SRG-OS-000257-GPOS-00098, SRG-OS-000278-GPOS-00108
Check Content
Verify the file permissions, ownership, and group membership of system files and commands match the vendor values. Check the default file permissions, ownership, and group membership of system files and commands with the following command: # for i in `rpm -Va | grep -E '^.{1}M|^.{5}U|^.{6}G' | cut -d " " -f 4,5`;do for j in `rpm -qf $i`;do rpm -ql $j --dump | cut -d " " -f 1,5,6,7 | grep $i;done;done /var/log/gdm 040755 root root /etc/audisp/audisp-remote.conf 0100640 root root /usr/bin/passwd 0104755 root root For each file returned, verify the current permissions, ownership, and group membership: # ls -la <filename> -rw-------. 1 root root 2017 Nov 1 10:03 /etc/audisp/audisp-remote.conf If the file is more permissive than the default permissions, this is a finding. If the file is not owned by the default owner and is not documented with the Information System Security Officer (ISSO), this is a finding. If the file is not a member of the default group and is not documented with the Information System Security Officer (ISSO), this is a finding.
Fix Text
Run the following command to determine which package owns the file: # rpm -qf <filename> Reset the user and group ownership of files within a package with the following command: # rpm --setugids <packagename> Reset the permissions of files within a package with the following command: # rpm --setperms <packagename>
Additional Identifiers
Rule ID: SV-204392r880752_rule
Vulnerability ID: V-204392
Group Title: SRG-OS-000257-GPOS-00098
Expert Comments
CCIs
| Number | Definition |
|---|---|
| CCI-001494 |
The information system protects audit tools from unauthorized modification. |
| CCI-001496 |
The information system implements cryptographic mechanisms to protect the integrity of audit tools. |
| CCI-002165 |
The information system enforces organization-defined discretionary access control policies over defined subjects and objects. |
| CCI-002235 |
The information system prevents non-privileged users from executing privileged functions to include disabling, circumventing, or altering implemented security safeguards/countermeasures. |