home *** CD-ROM | disk | FTP | other *** search
/ chilidog.highland.cc.ks.us / chilidog.highland.cc.ks.us.zip / chilidog.highland.cc.ks.us / backup / bradford.20101004.etc.tar.gz / bradford.20101004.etc.tar / etc / permissions < prev    next >
Text File  |  2006-04-22  |  9KB  |  188 lines
  1. # /etc/permissions
  2. #
  3. # Copyright (c) 2001 SuSE GmbH Nuernberg, Germany.  All rights reserved.
  4. #
  5. # Author: Roman Drahtmueller <draht@suse.de>, 2001
  6. #
  7. # This file is used by SuSEconfig and chkstat to check or set the modes
  8. # and ownerships of files and directories in the installation.
  9. #
  10. # There is a set of files with similar meaning in a SuSE installation:
  11. # /etc/permissions  (This file)
  12. # /etc/permissions.easy
  13. # /etc/permissions.secure
  14. # /etc/permissions.paranoid
  15. # /etc/permissions.local
  16. # Please see the respective files for their meaning.
  17. #
  18. #
  19. # Format: 
  20. # <file> <owner>:<group> <permission> 
  21. #
  22. # How it works:
  23. # Change the entries as you like, then call
  24. # `chkstat -set /etc/permissions┤ or /etc/permissions.{easy,secure,paranoid}
  25. # respectively, or call `SuSEconfig┤ as yast do after they think
  26. # that files have been modified in the system.
  27. #
  28. # SuSEconfig will use the files /etc/permissions and the ones ending
  29. # in what the variable PERMISSION_SECURITY from
  30. # /etc/sysconfig/security contains. By default, these are the files
  31. # /etc/permissions, /etc/permissions.easy and /etc/permissions.local
  32. # for local changes by the admin. In addition, the directory
  33. # /etc/permissions.d/ can contain permission files that belong to
  34. # the packages they modify file modes for. These permission files
  35. # are to switch between conflicting file modes of the same file
  36. # paths in different packages (popular example: sendmail and
  37. # postfix, path /usr/sbin/sendmail).
  38. #
  39. # SuSEconfig's usage of the chkstat program can be turned off completely
  40. # by setting CHECK_PERMISSIONS to "warn" in /etc/sysconfig/security.
  41. #
  42. # /etc/permissions is kept to the bare minimum. File modes that differ
  43. # from the settings in this file should be considered broken.
  44. #
  45. # Please see the headers of the files
  46. #   /etc/permissions.easy
  47. #   /etc/permissions.secure
  48. #   /etc/permissions.paranoid
  49. # as well as
  50. #   /etc/permissions.local
  51. # for more information about their particular meaning and their setup.
  52.  
  53. #
  54. # root directories:
  55. #
  56.  
  57. /                                                       root:root          755
  58. /root                                                   root:root          700
  59. /tmp                                                    root:root         1777
  60. /tmp/.X11-unix/                                         root:root         1777
  61. /tmp/.ICE-unix/                                         root:root         1777
  62. /dev                                                    root:root          755
  63. /bin                                                    root:root          755
  64. /sbin                                                   root:root          755
  65. /lib                                                    root:root          755
  66. /etc                                                    root:root          755
  67. /home                                                   root:root          755
  68. /boot                                                   root:root          755
  69. /opt                                                    root:root          755
  70. /usr                                                    root:root          755
  71.  
  72. #
  73. # /var:
  74. #
  75.  
  76. /var/tmp                                                root:root         1777
  77. /var/tmp/vi.recover/                                    root:root         1777
  78. /var/log                                                root:root          755
  79. /var/spool                                              root:root          755
  80. /var/spool/atjobs                                       at:at              700
  81. /var/spool/atjobs/.SEQ                                  at:at              600
  82. /var/spool/atjobs/.lockfile                             at:at              600
  83. /var/spool/atspool                                      at:at              700
  84. /var/spool/cron                                         root:root          700
  85. /var/spool/mqueue                                       root:root          700
  86. /var/spool/news                                         news:news          775
  87. /var/spool/uucp                                         uucp:uucp          755
  88. /var/spool/voice                                        root:root          755
  89. /var/spool/mail                                         root:root         1777
  90. /var/adm                                                root:root          755
  91. /var/adm/backup                                         root:root          700
  92. /var/cache                                              root:root          755
  93. /var/cache/fonts                                        root:root         1777
  94. /var/cache/man                                          man:root           755
  95. /var/yp                                                 root:root          755
  96. /var/run/nscd/socket                    root:root       666
  97. /var/run/sudo                                           root:root          700
  98.  
  99. #
  100. # log files that do not grow remarkably
  101. #
  102. /var/log/faillog                                        root:root          600
  103. # This file is not writeable by gid tty so that the information
  104. # therein can be trusted.
  105. /var/log/lastlog                                        root:tty           644
  106.  
  107.  
  108. #
  109. # some device files
  110. #
  111.  
  112. /dev/zero                                               root:root          666
  113. /dev/null                                               root:root          666
  114. /dev/full                                               root:root          622
  115. /dev/ip                                                 root:root          660
  116. /dev/initrd                                             root:disk          660
  117. /dev/kmem                                               root:kmem          640
  118.  
  119. #
  120. # /etc
  121. #
  122. /etc/lilo.conf                                          root:root          600
  123. /etc/passwd                                             root:root          644
  124. /etc/shadow                                             root:shadow        640
  125. /etc/init.d                                             root:root          755
  126. /etc/HOSTNAME                                           root:root          644
  127. /etc/hosts                                              root:root          644
  128. # Changing the hosts_access(5) files causes trouble with services
  129. # that do not run as root!
  130. /etc/hosts.allow                                        root:root          644
  131. /etc/hosts.deny                                         root:root          644
  132. /etc/hosts.equiv                                        root:root          644
  133. /etc/hosts.lpd                                          root:root          644
  134. /etc/ld.so.conf                                         root:root          644
  135. /etc/ld.so.cache                                        root:root          644
  136.  
  137. /etc/opiekeys                                           root:root          600
  138.  
  139. /etc/smpppd.conf                                        root:root          600
  140. /etc/smpppd-c.conf                                      root:dialout       640
  141. /var/run/smpppd                                         root:dialout       750
  142.  
  143. /etc/ppp                                                root:dialout       750
  144. /etc/ppp/chap-secrets                                   root:root          600
  145. /etc/ppp/pap-secrets                                    root:root          600
  146.  
  147. # sysconfig files:
  148. /etc/sysconfig/network/providers                        root:root          700
  149.  
  150. # utempter
  151. /usr/sbin/utempter                                      root:tty          2755
  152.  
  153. # changing the global ssh client configuration makes it unreadable
  154. # and therefore useless. Keep in mind that users can bring their own client!
  155. /etc/ssh/ssh_host_key                                   root:root          600
  156. /etc/ssh/ssh_host_key.pub                               root:root          644
  157. /etc/ssh/ssh_config                                     root:root          644
  158. /etc/ssh/sshd_config                                    root:root          640
  159.  
  160. #
  161. # legacy
  162. #
  163. # don't set the setuid bit on suidperl! Set it on sperl instead if
  164. # you really need it as suidperl is a hardlink to perl nowadays.
  165. /usr/bin/suidperl                                       root:root          755
  166.  
  167. # this made my X die. As punishment it gets the setuid bit removed.
  168. # Use it directly as root if you need it.
  169. /usr/X11R6/bin/dga                                      root:root          755
  170.  
  171. # cdrecord does not need to be setuid root as it uses resmgr for
  172. # accessing the devices. Access to that one can be configured in
  173. # /etc/resmgr.conf
  174. /usr/bin/cdrecord                                       root:root          755
  175.  
  176. # new traceroute program by Olaf Kirch does not need setuid root any more.
  177. /usr/sbin/traceroute                                    root:root          755
  178.  
  179. # netatalk printer daemon: sgid not needed any more with cups.
  180. /usr/sbin/papd                                          root:lp           0755
  181.  
  182. # safe as long as we don't change files below it (#103186)
  183. /var/games/                                             games:games       0775
  184.  
  185. # No longer common. Set setuid bit yourself if you need it
  186. # (#66191)
  187. #/usr/bin/ziptool                                        root:trusted      4750
  188.