Uploaded image for project: 'RHEL'
  1. RHEL
  2. RHEL-150283

"Ensure All User Initialization Files Have Mode 0740 Or Less Permissive" rules remediation text is incorrect

Linking RHIVOS CVEs to...Migration: Automation ...Sync from "Extern...XMLWordPrintable

    • Icon: Bug Bug
    • Resolution: Unresolved
    • Icon: Undefined Undefined
    • None
    • rhel-10.1
    • scap-security-guide
    • None
    • No
    • Low
    • rhel-security-compliance
    • None
    • False
    • False
    • Hide

      None

      Show
      None
    • None
    • None
    • None
    • None
    • Unspecified
    • Unspecified
    • Unspecified
    • None

      What were you trying to do that didn't work?

      The rule xccdf_org.ssgproject.content_rule_file_permission_user_init_files has incorrect remediation text (not script, just the text): it states to change mode to 0740 to all dot files:

      Set the mode of the user initialization files to 0740 with the following command:
      ~~~
      $ sudo chmod 0740 /home/USER/.INIT_FILE
      ~~~
      

      This is not correct, dot files are not executable. Instead it should state to remove unexpected bits, similar to what is done in the remediation shell script already:

      Set the mode of the user initialization files to 0740 or lower with the following command:
      ~~~
      $ sudo chmod u-s,g-wxs,o= /home/USER/.INIT_FILE
      ~~~
      

      Additionally the rule specific to "user and root" files (xccdf_org.ssgproject.content_rule_file_permission_user_init_files_root) has same issue.
      The rule is not selected by CIS level 1 but should be fixed as well.

      What is the impact of this issue to you?

      Adds unwanted permissions to dot files.

      Please provide the package NVR for which the bug is seen:

      scap-security-guide-0.1.79-2.el10.noarch

      How reproducible is this bug?

      Always

              vpolasek@redhat.com Vojtech Polasek
              rhn-support-rmetrich Renaud Métrich
              Vojtech Polasek Vojtech Polasek
              SSG Security QE SSG Security QE
              Votes:
              0 Vote for this issue
              Watchers:
              7 Start watching this issue

                Created:
                Updated: