STIGQter: STIG Summary: Oracle Linux 7 Security Technical Implementation Guide Version: 2 Release: 3 Benchmark Date: 23 Apr 2021:

The Oracle Linux operating system must be configured so that the file permissions, ownership, and group membership of system files and commands match the vendor values.

DISA Rule

SV-221652r646955_rule

Vulnerability Number

V-221652

Group Title

SRG-OS-000256-GPOS-00097

Rule Version

OL07-00-010010

Severity

CAT I

CCI(s)

• CCI-001494 - The information system protects audit tools from unauthorized modification.
• CCI-001496 - The information system implements cryptographic mechanisms to protect the integrity of audit tools.

Weight

10

Fix Recommendation

Run the following command to determine which package owns the file:

# rpm -qf <filename>

Reset the user and group ownership of files within a package with the following command:

# rpm --setugids <packagename>

Reset the permissions of files within a package with the following command:

# rpm --setperms <packagename>

Check Contents

Verify the file permissions, ownership, and group membership of system files and commands match the vendor values.

Check the default file permissions, ownership, and group membership of system files and commands with the following command:

# for i in `rpm -Va | egrep '^.{1}M|^.{5}U|^.{6}G' | cut -d "" "" -f 4,5`;do for j in `rpm -qf $i`;do rpm -ql $j --dump | cut -d "" "" -f 1,5,6,7 | grep $i;done;done
/var/log/gdm 040755 root root
/etc/audisp/audisp-remote.conf 0100640 root root
/usr/bin/passwd 0104755 root root

For each file returned, verify the current permissions, ownership, and group membership:
# ls -la <filename>
-rw-------. 1 root root 133 Jan 11 13:25 /etc/audisp/audisp-remote.conf

If the file is more permissive than the default permissions, this is a finding.

If the file is not owned by the default owner and is not documented with the Information System Security Officer (ISSO), this is a finding.

If the file is not a member of the default group and is not documented with the ISSO, this is a finding.

Vulnerability Number

V-221652

Documentable

False

Rule Version

OL07-00-010010

Severity Override Guidance

Verify the file permissions, ownership, and group membership of system files and commands match the vendor values.

Check the default file permissions, ownership, and group membership of system files and commands with the following command:

# for i in `rpm -Va | egrep '^.{1}M|^.{5}U|^.{6}G' | cut -d "" "" -f 4,5`;do for j in `rpm -qf $i`;do rpm -ql $j --dump | cut -d "" "" -f 1,5,6,7 | grep $i;done;done
/var/log/gdm 040755 root root
/etc/audisp/audisp-remote.conf 0100640 root root
/usr/bin/passwd 0104755 root root

For each file returned, verify the current permissions, ownership, and group membership:
# ls -la <filename>
-rw-------. 1 root root 133 Jan 11 13:25 /etc/audisp/audisp-remote.conf

If the file is more permissive than the default permissions, this is a finding.

If the file is not owned by the default owner and is not documented with the Information System Security Officer (ISSO), this is a finding.

If the file is not a member of the default group and is not documented with the ISSO, this is a finding.

Check Content Reference

M

Target Key

4089

Comments