home *** CD-ROM | disk | FTP | other *** search
/ tusportal.tus.k12.pa.us / tusportal.tus.k12.pa.us.tar / tusportal.tus.k12.pa.us / Wyse / latest-image.raw / 0.img / etc / permissions.paranoid < prev    next >
Text File  |  2010-05-05  |  22KB  |  446 lines
  1. # /etc/permissions.paranoid
  2. #
  3. # Copyright (c) 2001 SuSE GmbH Nuernberg, Germany.  All rights reserved.
  4. #
  5. # Author: Roman Drahtmueller <draht@suse.de>, 2001
  6. #
  7. # 
  8. # See /etc/permissions for general hints on how to use this file.
  9. #
  10. # /etc/permissions.paranoid is NOT designed to be used in a single-user as
  11. # well as a multi-user installation, be it networked or not.
  12. # Derived from /etc/permissions.secure, it has _all_ sgid and suid bits
  13. # cleared - therefore, the system might be useable for non-privileged users
  14. # except for simple tasks like changing passwords and such. In addition, 
  15. # some of the configuration files are not readable for world any more.
  16. #
  17. # Feel free to use this file as a basis of a system configuration that meets
  18. # your understanding of "secure", for the case that you're a bit paranoid.
  19. # Since there is no such thing as "it works" with this configuration, please
  20. # use these settings with care. Some experience on behalf of the administrator
  21. # is needed to have a system running flawlessly when users are present.
  22. # In particular, all terminal emulators will not be able to write to utmp
  23. # and wtmp any more, which renders who(1) and finger(1) useless.
  24. #
  25. # Please always keep in mind that your system listens on network sockets
  26. # in the default configuration. Change this by disabling the services that 
  27. # you do not need or by restricting access to them using packet filters
  28. # or tcp wrappers (see hosts_access(5)) to gain a higher level of security
  29. # in your system.
  30.  
  31. #
  32. # Directories
  33. #
  34. # no lock files for emacs:
  35. /var/lib/xemacs/lock                                    root:trusted      1775
  36. # for screen's session sockets:
  37. /var/run/uscreens                                       root:trusted      1775
  38.  
  39.  
  40. #
  41. # /etc
  42. #
  43. /etc/crontab                                            root:root          600
  44. /etc/exports                                            root:root          600
  45. /etc/fstab                                              root:root          600
  46. /etc/ftpaccess                                          root:root          600
  47. /etc/ftpusers                                           root:root          600
  48. /etc/inetd.conf                                         root:root          600
  49. /etc/inittab                                            root:root          600
  50. /etc/mtab                                               root:root          600
  51. /etc/rmtab                                              root:root          600
  52. /var/lib/nfs/rmtab                                      root:root          600
  53. /etc/syslog.conf                                        root:root          600
  54.  
  55. #
  56. # suid system programs that need the suid bit to work:
  57. #
  58. /bin/su                                                 root:root         0755
  59. # disable at and cron for non-root users
  60. /usr/bin/at                                             root:trusted      0755
  61. /usr/bin/crontab                                        root:trusted      0755
  62. /usr/bin/gpasswd                                        root:shadow       0755
  63. /usr/bin/newgrp                                         root:root         0755
  64. /usr/bin/passwd                                         root:shadow       0755
  65. /usr/bin/chfn                                           root:shadow       0755
  66. /usr/bin/chage                                          root:shadow       0755
  67. /usr/bin/chsh                                           root:shadow       0755
  68. /usr/bin/expiry                                         root:shadow       0755
  69. # the default configuration of the sudo package in SuSE distribution is to
  70. # intimidate users.
  71. /usr/bin/sudo                                           root:root         0755
  72. /usr/sbin/su-wrapper                                    root:root         0755
  73. # opie password system
  74. # #66303
  75. /usr/bin/opiepasswd                                     root:root         0755
  76. /usr/bin/opiesu                                         root:root         0755
  77. # "user" entries in /etc/fstab make mount work for non-root users:
  78. /usr/bin/ncpmount                                       root:trusted      0755
  79. /usr/bin/ncpumount                                      root:trusted      0755
  80. # #331020
  81. /sbin/mount.nfs                                         root:root         0755
  82. # mount/umount have had their problems already:
  83. /bin/mount                                              root:root         0755
  84. /bin/umount                                             root:root         0755
  85. /bin/eject                                              root:audio        0755
  86. #
  87. # #133657
  88. /usr/bin/fusermount                                     root:trusted      0755
  89. # #66203
  90. /usr/lib/majordomo/wrapper                              root:daemon       0755
  91. # glibc backwards compatibility
  92. /usr/lib/pt_chown                                       root:root         0755
  93. /usr/lib64/pt_chown                                     root:root         0755
  94. # needs setuid root when using shadow via NIS:
  95. # #216816
  96. /sbin/unix_chkpwd                                       root:shadow       0755
  97. /sbin/unix2_chkpwd                                      root:shadow       0755
  98. # qpopper
  99. /usr/sbin/popauth                                       pop:trusted       0755
  100. # from the squid package
  101. /usr/sbin/pam_auth                                      root:shadow       0755
  102.  
  103. # still to be converted to utempter
  104. /usr/lib/vte/gnome-pty-helper                           root:tty          0755
  105.  
  106. #
  107. # mixed section: most of it is disabled in this permissions.secure:
  108. #
  109. #########################################################################
  110. # rpm subsystem:
  111. /usr/src/packages/SOURCES/                              root:root          700
  112. /usr/src/packages/BUILD/                                root:root          700
  113. /usr/src/packages/RPMS/                                 root:root          700
  114. /usr/src/packages/RPMS/alpha/                           root:root          700
  115. /usr/src/packages/RPMS/alphaev56/                       root:root          700
  116. /usr/src/packages/RPMS/alphaev67/                       root:root          700
  117. /usr/src/packages/RPMS/alphaev6/                        root:root          700
  118. /usr/src/packages/RPMS/arm4l/                           root:root          700
  119. /usr/src/packages/RPMS/athlon/                          root:root          700
  120. /usr/src/packages/RPMS/i386/                            root:root          700
  121. /usr/src/packages/RPMS/i486/                            root:root          700
  122. /usr/src/packages/RPMS/i586/                            root:root          700
  123. /usr/src/packages/RPMS/i686/                            root:root          700
  124. /usr/src/packages/RPMS/ia64/                            root:root          700
  125. /usr/src/packages/RPMS/mips/                            root:root          700
  126. /usr/src/packages/RPMS/ppc/                             root:root          700
  127. /usr/src/packages/RPMS/ppc64/                           root:root          700
  128. /usr/src/packages/RPMS/powerpc/                         root:root          700
  129. /usr/src/packages/RPMS/powerpc64/                       root:root          700
  130. /usr/src/packages/RPMS/s390/                            root:root          700
  131. /usr/src/packages/RPMS/s390x/                           root:root          700
  132. /usr/src/packages/RPMS/sparc/                           root:root          700
  133. /usr/src/packages/RPMS/sparcv9/                         root:root          700
  134. /usr/src/packages/RPMS/sparc64/                         root:root          700
  135. /usr/src/packages/RPMS/x86_64/                          root:root          700
  136. /usr/src/packages/RPMS/armv4l/                          root:root          700
  137. /usr/src/packages/RPMS/hppa/                            root:root          700
  138. /usr/src/packages/RPMS/hppa2.0/                         root:root          700
  139. /usr/src/packages/RPMS/noarch/                          root:root          700
  140. /usr/src/packages/SPECS/                                root:root          700
  141. /usr/src/packages/SRPMS/                                root:root          700
  142. #########################################################################
  143. # video
  144. /usr/bin/v4l-conf                                       root:video        0755
  145. # Itanium ia32 emulator
  146. /usr/lib/ia32el/suid_ia32x_loader                       root:root         0755
  147. #########################################################################
  148. # scotty:
  149. # #66211
  150. /usr/bin/ntping                                         root:trusted      0755
  151. # This is not extensively tested.
  152. /usr/bin/vlock                                          root:shadow       0755
  153. /usr/bin/Xorg                                           root:root         0711
  154. # turned off write and wall by disabling sgid tty:
  155. /usr/bin/wall                                           root:tty          0755
  156. /usr/bin/write                                          root:tty          0755
  157. # thttpd
  158. /usr/bin/makeweb                                        root:www          0750
  159. # yaps, pager software, accesses /dev/ttyS? . Disabled sgid uucp.
  160. /usr/bin/yaps                                           root:uucp         0755
  161. # ncpfs tool: trusted only
  162. /usr/bin/nwsfind                                        root:trusted      0750
  163. /usr/bin/ncplogin                                       root:trusted      0750
  164. /usr/bin/ncpmap                                         root:trusted      0750
  165. # lpdfilter:
  166. # checks itself that only lp and root can call it
  167. /usr/lib/lpdfilter/bin/runlpr                           root:root         0755
  168. # pcmcia:
  169. # Needs setuid to eject cards (#100120)
  170. /sbin/pccardctl                                         root:trusted      0755
  171. # gnokii nokia cellphone software
  172. # #66209
  173. /usr/sbin/mgnokiidev                                    root:uucp          755
  174. # pcp, performance co-pilot
  175. # setuid root is used to write /var/log/pcp/NOTICES
  176. # #66205
  177. /usr/lib/pcp/pmpost                                     root:trusted      0755
  178. # mailman mailing list software
  179. # #66315
  180. /usr/lib/mailman/cgi-bin/admin                          root:mailman      0755
  181. /usr/lib/mailman/cgi-bin/admindb                        root:mailman      0755
  182. /usr/lib/mailman/cgi-bin/edithtml                       root:mailman      0755
  183. /usr/lib/mailman/cgi-bin/listinfo                       root:mailman      0755
  184. /usr/lib/mailman/cgi-bin/options                        root:mailman      0755
  185. /usr/lib/mailman/cgi-bin/private                        root:mailman      0755
  186. /usr/lib/mailman/cgi-bin/roster                         root:mailman      0755
  187. /usr/lib/mailman/cgi-bin/subscribe                      root:mailman      0755
  188. /usr/lib/mailman/cgi-bin/confirm                        root:mailman      0755
  189. /usr/lib/mailman/cgi-bin/create                         root:mailman      0755
  190. /usr/lib/mailman/cgi-bin/editarch                       root:mailman      0755
  191. /usr/lib/mailman/cgi-bin/rmlist                         root:mailman      0755
  192. /usr/lib/mailman/mail/mailman                           root:mailman      0755
  193.  
  194. # libgnomesu (#75823, #175616)
  195. /usr/lib/libgnomesu/gnomesu-pam-backend                 root:root         0755
  196.  
  197. # control-center2 (#104993)
  198. /usr/sbin/change-passwd                                 root:root         0755
  199.  
  200. #
  201. # cups (#66305,#406058)
  202. #
  203. /usr/bin/lppasswd                                       lp:lp             0755
  204.  
  205. #
  206. # smb printing with kerberos authentication (#177114)
  207. #
  208. /usr/bin/get_printing_ticket                            root:lp           0755
  209.  
  210. #
  211. # networking (need root for the privileged socket)
  212. #
  213. /bin/ping                                               root:root         0755
  214. /bin/ping6                                              root:root         0755
  215. /usr/sbin/traceroute6                                   root:root         0755
  216. # mtr is linked against ncurses.
  217. /usr/sbin/mtr                                           root:dialout      0755
  218. /usr/bin/rcp                                            root:root         0755
  219. /usr/bin/rlogin                                         root:root         0755
  220. /usr/bin/rsh                                            root:root         0755
  221.  
  222. # heartbeat #66310
  223. # cl_status needs to be allowed to connect to the heartbeat API. If the setgid
  224. # bit is removed, one can manually add users to the haclient group instead.
  225. /usr/bin/cl_status                                      root:haclient     0555
  226.  
  227. # exim
  228. /usr/sbin/exim                                          root:root         0755
  229.  
  230. #
  231. # dialup networking programs
  232. #
  233. /usr/sbin/pppoe-wrapper                                 root:dialout      0750
  234. # i4l package (#100750):
  235. /sbin/isdnctrl                                          root:dialout      0750
  236. # #66111
  237. /usr/bin/vboxbeep                                       root:trusted      0755
  238.  
  239.  
  240. #
  241. # linux text console utilities
  242. #
  243. # setuid needed on the text console to set the terminal content on ctrl-o
  244. # #66112
  245. /usr/lib/mc/cons.saver                                  root:root         0755
  246.  
  247.  
  248. #
  249. # terminal emulators
  250. # This and future SuSE products have support for the utempter, a small helper
  251. # program that does the utmp/wtmp update work with the necessary rights.
  252. # The use of utempter obsoletes the need for sgid bits on terminal emulator
  253. # binaries. We mention screen here, but all other terminal emulators have
  254. # moved to /etc/permissions, with modes set to 0755.
  255.  
  256. # framebuffer terminal emulator (japanese).
  257. /usr/bin/jfbterm                                        root:tty          0755
  258.  
  259. #
  260. # kde
  261. #
  262. # arts wrapper, normally suid root:
  263. /opt/kde3/bin/artswrapper                               root:root         0755
  264. # needs setuid root when using shadow via NIS:
  265. # #66218
  266. /opt/kde3/bin/kcheckpass                                root:shadow       0755
  267. /usr/lib/kde4/libexec/kcheckpass                        root:shadow       0755
  268. /usr/lib64/kde4/libexec/kcheckpass                      root:shadow       0755
  269. # This has a meaning... hmm...
  270. /opt/kde3/bin/kdesud                                    root:nogroup      0755
  271. /usr/lib/kde4/libexec/kdesud                            root:nogroup      0755
  272. /usr/lib64/kde4/libexec/kdesud                          root:nogroup      0755
  273. # used for getting proxy settings from dhcp
  274. /opt/kde3/bin/kpac_dhcp_helper                          root:root         0755
  275. # used to distract the oom killer
  276. # #203535
  277. /opt/kde3/bin/start_kdeinit                             root:root         0755
  278. # edits /etc/smb.conf
  279. # #66312
  280. /usr/bin/fileshareset                                   root:root         0755
  281.  
  282.  
  283. #
  284. # amanda
  285. #
  286. # Well, if you are gid disk already, you don't need these amanda binaries
  287. # to get root.
  288. # Anyway, we don't keep the suid bits.
  289. /usr/sbin/amcheck                                       root:disk         0750
  290. /usr/lib/amanda/calcsize                                root:disk         0750
  291. /usr/lib/amanda/rundump                                 root:disk         0750
  292. /usr/lib/amanda/planner                                 root:disk         0750
  293. /usr/lib/amanda/runtar                                  root:disk         0750
  294. /usr/lib/amanda/dumper                                  root:disk         0750
  295. /usr/lib/amanda/killpgrp                                root:disk         0750
  296.  
  297.  
  298. #
  299. # gnats
  300. #
  301. /usr/lib/gnats/gen-index                                gnats:root        0555
  302. /usr/lib/gnats/pr-edit                                  gnats:root        0555
  303. /usr/lib/gnats/queue-pr                                 gnats:root        0555
  304.  
  305.  
  306. #
  307. # news (inn)
  308. #
  309. # the inn start script changes it's uid to news:news. Later innstart and
  310. # innfeed are called by this user. Those programs do not need to be called by
  311. # anyone else, therefore the strange permissions 4554 are required for
  312. # operation. (#67032)
  313. #
  314. /usr/lib/news/bin/rnews                                 news:uucp         0555
  315. /usr/lib/news/bin/startinnfeed                          root:news         0555
  316. /usr/lib/news/bin/inndstart                             root:news         0555
  317. /usr/lib/news/bin/inews                                 news:news         0555
  318.  
  319.  
  320. #
  321. # fax
  322. #
  323. # restrictive, only for "trusted" group users:
  324. # faxq helper:
  325. /usr/lib/mgetty+sendfax/faxq-helper                     fax:root          0711
  326. /var/spool/fax/outgoing                                 fax:trusted       1770
  327. /var/spool/fax/outgoing/locks                           fax:trusted       1770
  328. # TODO: package should set this permissions
  329. /var/spool/fax/archive                                  fax:uucp           700
  330. /var/spool/fax/bin                                      fax:uucp           755
  331. /var/spool/fax/client                                   fax:uucp           755
  332. /var/spool/fax/config                                   fax:uucp           755
  333. /var/spool/fax/dev                                      fax:uucp           755
  334. /var/spool/fax/docq                                     fax:uucp           700
  335. /var/spool/fax/doneq                                    fax:uucp           700
  336. /var/spool/fax/etc                                      fax:uucp           755
  337. /var/spool/fax/info                                     fax:uucp           755
  338. /var/spool/fax/log                                      fax:uucp           755
  339. /var/spool/fax/pollq                                    fax:uucp           700
  340. /var/spool/fax/recvq                                    fax:uucp           755
  341. /var/spool/fax/sendq                                    fax:uucp           700
  342. /var/spool/fax/status                                   fax:uucp           755
  343. /var/spool/fax/tmp                                      fax:uucp           700
  344.  
  345. #
  346. # uucp
  347. #
  348. /var/spool/uucppublic                                   root:uucp         1770
  349. /usr/bin/uucp                                           uucp:uucp         0555
  350. /usr/bin/uuname                                         uucp:uucp         0555
  351. /usr/bin/uustat                                         uucp:uucp         0555
  352. /usr/bin/uux                                            uucp:uucp         0555
  353. /usr/lib/uucp/uucico                                    uucp:uucp         0555
  354. /usr/lib/uucp/uuxqt                                     uucp:uucp         0555
  355.  
  356.  
  357. #
  358. # games of all kinds, toys
  359. #
  360.  
  361. # bsd-games
  362. /usr/games/atc                                          games:games       0755
  363. /usr/games/battlestar                                   games:games       0755
  364. /usr/games/canfield                                     games:games       0755
  365. /usr/games/cribbage                                     games:games       0755
  366. /usr/games/phantasia                                    games:games       0755
  367. /usr/games/robots                                       games:games       0755
  368. /usr/games/sail                                         games:games       0755
  369. /usr/games/snake                                        games:games       0755
  370. /usr/games/tetris-bsd                                   games:games       0755
  371.  
  372. # Maelstrom
  373. /usr/games/Maelstrom                                    games:games       0755
  374.  
  375. # pachi
  376. /usr/games/pachi                                        games:games       0755
  377. /usr/games/martian                                      games:games       0755
  378.  
  379. # nethack
  380. /usr/lib/nethack/nethack.tty                            games:games       0755
  381.  
  382. # chromium,
  383. /usr/games/chromium                                     games:games       0755
  384.  
  385. # xscrabble
  386. /usr/games/xscrab                                       games:games       0755
  387.  
  388. # trackballs
  389. /usr/games/trackballs                                   games:games       0755
  390.  
  391. # ltris
  392. /usr/games/ltris                                        games:games       0755
  393.  
  394. # xlogical
  395. /usr/games/xlogical                                     games:games       0755
  396.  
  397. # lbreakout
  398. /usr/games/lbreakout2                                   games:games       0755
  399.  
  400. # xgalaga
  401. /usr/bin/xgalaga                                        games:games       0755
  402.  
  403. # rocksndiamonds
  404. /usr/games/rocksndiamonds                               games:games       0755
  405.  
  406. # gnome-games
  407. /usr/bin/glines                                         games:games       0755
  408. /usr/bin/gnibbles                                       games:games       0755
  409. /usr/bin/gnobots2                                       games:games       0755
  410. /usr/bin/gnometris                                      games:games       0755
  411. /usr/bin/gnomine                                        games:games       0755
  412. /usr/bin/gnotravex                                      games:games       0755
  413. /usr/bin/gnotski                                        games:games       0755
  414. /usr/bin/gtali                                          games:games       0755
  415. /usr/bin/mahjongg                                       games:games       0755
  416. /usr/bin/same-gnome                                     games:games       0755
  417.  
  418. # zypp (#385207)
  419. /usr/sbin/zypp-refresh-wrapper                          root:root         0755
  420.  
  421. # PolicyKit (#295341)
  422. /usr/lib/PolicyKit/polkit-set-default-helper            root:polkituser   0755
  423. /usr/lib/PolicyKit/polkit-read-auth-helper              root:polkituser   0755
  424. /usr/lib/PolicyKit/polkit-revoke-helper                 root:polkituser   0755
  425. /usr/lib/PolicyKit/polkit-explicit-grant-helper         root:polkituser   0755
  426. /usr/lib/PolicyKit/polkit-grant-helper                  root:polkituser   0755
  427. /usr/lib/PolicyKit/polkit-grant-helper-pam              root:polkituser   0755
  428.  
  429. # dbus-1 (#333361)
  430. /lib/dbus-1/dbus-daemon-launch-helper                   root:messagebus   0750
  431. /lib64/dbus-1/dbus-daemon-launch-helper                 root:messagebus   0750
  432.  
  433. # policycoreutils (#440596)
  434. /usr/bin/newrole                                        root:root         0755
  435.  
  436. # VirtualBox (#429725)
  437. /usr/lib/virtualbox/VirtualBox                          root:vboxusers    0755
  438. /usr/lib/virtualbox/VirtualBox3                         root:vboxusers    0755
  439. /usr/lib/virtualbox/VBoxBFE                             root:vboxusers    0755
  440. /usr/lib/virtualbox/VBoxHeadless                        root:vboxusers    0755
  441. /usr/lib/virtualbox/VBoxSDL                             root:vboxusers    0755
  442.  
  443. # binary only nicimud (bnc#591372)
  444. /var/opt/novell/nici/nicimud                            root:root         0755
  445. /var/opt/novell/nici/nicimud64                          root:root         0755
  446.