The Red Hat Enterprise Linux operating system must be configured so that the file permissions, ownership, and group membership of system files and commands match the vendor values.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-71849	RHEL-07-010010	SV-86473r4_rule		High

Description
Discretionary access control is weakened if a user or group has access permissions to system files and directories greater than the default. Satisfies: SRG-OS-000257-GPOS-00098, SRG-OS-000278-GPOS-00108

STIG	Date
Red Hat Enterprise Linux 7 Security Technical Implementation Guide	2020-05-15

Details

Check Text ( C-72081r8_chk )
Verify the file permissions, ownership, and group membership of system files and commands match the vendor values. Check the default file permissions, ownership, and group membership of system files and commands with the following command: # for i in `rpm -Va \| egrep -i '^\.[M\|U\|G\|.]{8}' \| cut -d " " -f4,5`;do for j in `rpm -qf $i`;do rpm -ql $j --dump \| cut -d " " -f1,5,6,7 \| grep $i;done;done /var/log/gdm 040755 root root /etc/audisp/audisp-remote.conf 0100640 root root /usr/bin/passwd 0104755 root root For each file returned, verify the current permissions, ownership, and group membership: # ls -la -rw-------. 1 root root 133 Jan 11 13:25 /etc/audisp/audisp-remote.conf If the file is more permissive than the default permissions, this is a finding. If the file is not owned by the default owner and is not documented with the Information System Security Officer (ISSO), this is a finding. If the file is not a member of the default group and is not documented with the Information System Security Officer (ISSO), this is a finding.

Check Text ( C-72081r8_chk )

Verify the file permissions, ownership, and group membership of system files and commands match the vendor values.

Check the default file permissions, ownership, and group membership of system files and commands with the following command:

# for i in `rpm -Va | egrep -i '^\.[M|U|G|.]{8}' | cut -d " " -f4,5`;do for j in `rpm -qf $i`;do rpm -ql $j --dump | cut -d " " -f1,5,6,7 | grep $i;done;done

/var/log/gdm 040755 root root
/etc/audisp/audisp-remote.conf 0100640 root root
/usr/bin/passwd 0104755 root root

For each file returned, verify the current permissions, ownership, and group membership:
# ls -la

-rw-------. 1 root root 133 Jan 11 13:25 /etc/audisp/audisp-remote.conf

If the file is more permissive than the default permissions, this is a finding.

If the file is not owned by the default owner and is not documented with the Information System Security Officer (ISSO), this is a finding.

If the file is not a member of the default group and is not documented with the Information System Security Officer (ISSO), this is a finding.

Fix Text (F-78201r4_fix)
Run the following command to determine which package owns the file: # rpm -qf Reset the user and group ownership of files within a package with the following command: #rpm --setugids Reset the permissions of files within a package with the following command: #rpm --setperms