home *** CD-ROM | disk | FTP | other *** search
/ chilidog.highland.cc.ks.us / chilidog.highland.cc.ks.us.zip / chilidog.highland.cc.ks.us / backup / bradford.20110502.etc.tar.gz / bradford.20110502.etc.tar / etc / permissions.paranoid < prev    next >
Text File  |  2006-04-22  |  22KB  |  450 lines
  1. # /etc/permissions.paranoid
  2. #
  3. # Copyright (c) 2001 SuSE GmbH Nuernberg, Germany.  All rights reserved.
  4. #
  5. # Author: Roman Drahtmueller <draht@suse.de>, 2001
  6. #
  7. # 
  8. # See /etc/permissions for general hints on how to use this file.
  9. #
  10. # /etc/permissions.paranoid is NOT designed to be used in a single-user as
  11. # well as a multi-user installation, be it networked or not.
  12. # Derived from /etc/permissions.secure, it has _all_ sgid and suid bits
  13. # cleared - therefore, the system might be useable for non-privileged users
  14. # except for simple tasks like changing passwords and such. In addition, 
  15. # some of the configuration files are not readable for world any more.
  16. #
  17. # Feel free to use this file as a basis of a system configuration that meets
  18. # your understanding of "secure", for the case that you're a bit paranoid.
  19. # Since there is no such thing as "it works" with this configuration, please
  20. # use these settings with care. Some experience on behalf of the administrator
  21. # is needed to have a system running flawlessly when users are present.
  22. # In particular, all terminal emulators will not be able to write to utmp
  23. # and wtmp any more, which renders who(1) and finger(1) useless.
  24. #
  25. # Please always keep in mind that your system listens on network sockets
  26. # in the default configuration. Change this by disabling the services that 
  27. # you do not need or by restricting access to them using packet filters
  28. # or tcp wrappers (see hosts_access(5)) to gain a higher level of security
  29. # in your system.
  30.  
  31. #
  32. # Directories
  33. #
  34. # no lock files for emacs:
  35. /var/lib/xemacs/lock                                    root:trusted      1775
  36. # for screen's session sockets:
  37. /var/run/uscreens                                       root:trusted      1775
  38.  
  39.  
  40. #
  41. # /etc
  42. #
  43. /etc/crontab                                            root:root          600
  44. /etc/exports                                            root:root          600
  45. /etc/fstab                                              root:root          600
  46. /etc/ftpaccess                                          root:root          600
  47. /etc/ftpusers                                           root:root          600
  48. /etc/inetd.conf                                         root:root          600
  49. /etc/inittab                                            root:root          600
  50. /etc/mtab                                               root:root          600
  51. /etc/rmtab                                              root:root          600
  52. /var/lib/nfs/rmtab                                      root:root          600
  53. /etc/syslog.conf                                        root:root          600
  54.  
  55. #
  56. # suid system programs that need the suid bit to work:
  57. #
  58. /bin/su                                                 root:root         0755
  59. # disable at and cron for non-root users
  60. /usr/bin/at                                             root:trusted      0755
  61. /usr/bin/crontab                                        root:trusted      0755
  62. /usr/bin/gpasswd                                        root:shadow       0755
  63. /usr/bin/newgrp                                         root:root         0755
  64. /usr/bin/passwd                                         root:shadow       0755
  65. /usr/bin/chfn                                           root:shadow       0755
  66. /usr/bin/chage                                          root:shadow       0755
  67. /usr/bin/chsh                                           root:shadow       0755
  68. /usr/bin/expiry                                         root:shadow       0755
  69. # the default configuration of the sudo package in SuSE distribution is to
  70. # intimidate users.
  71. /usr/bin/sudo                                           root:root         0755
  72. /usr/sbin/su-wrapper                                    root:root         0755
  73. # opie password system
  74. # #66303
  75. /usr/bin/opiepasswd                                     root:root         0755
  76. /usr/bin/opiesu                                         root:root         0755
  77. # "user" entries in /etc/fstab make mount work for non-root users:
  78. /usr/bin/ncpmount                                       root:trusted      0755
  79. /usr/bin/ncpumount                                      root:trusted      0755
  80. # mount/umount have had their problems already:
  81. /bin/mount                                              root:root         0755
  82. /bin/umount                                             root:root         0755
  83. /bin/eject                                              root:audio        0755
  84. #
  85. # #133657
  86. /usr/bin/fusermount                                     root:trusted      0755
  87. # #66203
  88. /usr/lib/majordomo/wrapper                              root:daemon       0755
  89. # glibc backwards compatibility
  90. /usr/lib/pt_chown                                       root:root         0755
  91. /usr/lib64/pt_chown                                     root:root         0755
  92. /sbin/unix_chkpwd                                       root:shadow       0755
  93. /sbin/unix2_chkpwd                                      root:shadow       0755
  94. # qpopper
  95. /usr/sbin/popauth                                       pop:trusted       0755
  96. # from the squid package
  97. /usr/sbin/pam_auth                                      root:shadow       0755
  98.  
  99. # still to be converted to utempter
  100. /opt/gnome/lib/vte/gnome-pty-helper                     root:tty          0755
  101.  
  102. # gpg cannot pin memory into the ram using mlock(2) if not suid.
  103. # In memory pressure conditions, memory pages containing sensitive information
  104. # can be paged to disk.
  105. # the suid bit also removes gpg's complaints wrt the insecure memory.
  106. # in permissions.paranoid, we remove the setuid bit following the rationale
  107. # described near the top of the file.
  108. /usr/bin/gpg                                            root:root         0755
  109.  
  110.  
  111.  
  112. #
  113. # mixed section: most of it is disabled in this permissions.secure:
  114. #
  115. #########################################################################
  116. # rpm subsystem:
  117. /usr/src/packages/SOURCES/                              root:root          700
  118. /usr/src/packages/BUILD/                                root:root          700
  119. /usr/src/packages/RPMS/                                 root:root          700
  120. /usr/src/packages/RPMS/alpha/                           root:root          700
  121. /usr/src/packages/RPMS/alphaev56/                       root:root          700
  122. /usr/src/packages/RPMS/alphaev67/                       root:root          700
  123. /usr/src/packages/RPMS/alphaev6/                        root:root          700
  124. /usr/src/packages/RPMS/arm4l/                           root:root          700
  125. /usr/src/packages/RPMS/athlon/                          root:root          700
  126. /usr/src/packages/RPMS/i386/                            root:root          700
  127. /usr/src/packages/RPMS/i486/                            root:root          700
  128. /usr/src/packages/RPMS/i586/                            root:root          700
  129. /usr/src/packages/RPMS/i686/                            root:root          700
  130. /usr/src/packages/RPMS/ia64/                            root:root          700
  131. /usr/src/packages/RPMS/mips/                            root:root          700
  132. /usr/src/packages/RPMS/ppc/                             root:root          700
  133. /usr/src/packages/RPMS/ppc64/                           root:root          700
  134. /usr/src/packages/RPMS/powerpc/                         root:root          700
  135. /usr/src/packages/RPMS/powerpc64/                       root:root          700
  136. /usr/src/packages/RPMS/s390/                            root:root          700
  137. /usr/src/packages/RPMS/s390x/                           root:root          700
  138. /usr/src/packages/RPMS/sparc/                           root:root          700
  139. /usr/src/packages/RPMS/sparcv9/                         root:root          700
  140. /usr/src/packages/RPMS/sparc64/                         root:root          700
  141. /usr/src/packages/RPMS/x86_64/                          root:root          700
  142. /usr/src/packages/RPMS/armv4l/                          root:root          700
  143. /usr/src/packages/RPMS/hppa/                            root:root          700
  144. /usr/src/packages/RPMS/hppa2.0/                         root:root          700
  145. /usr/src/packages/RPMS/noarch/                          root:root          700
  146. /usr/src/packages/SPECS/                                root:root          700
  147. /usr/src/packages/SRPMS/                                root:root          700
  148. #########################################################################
  149. # video
  150. /usr/X11R6/bin/v4l-conf                                 root:video        0755
  151. /opt/gnome/sbin/zapping_setup_fb                        root:video        0755
  152. # vmware
  153. /usr/bin/vmware                                         root:trusted      0755
  154. /usr/bin/vmware-ping                                    root:trusted      0755
  155. # Itanium ia32 emulator
  156. /usr/lib/ia32el/suid_ia32x_loader                       root:root         0755
  157. #########################################################################
  158. # scotty:
  159. # #66211
  160. /usr/bin/ntping                                         root:trusted      0755
  161. # This is not extensively tested.
  162. /usr/bin/vlock                                          root:shadow       0755
  163. /usr/X11R6/bin/Xorg                                     root:root         0711
  164. /usr/bin/man                                            root:root         0755
  165. /usr/bin/mandb                                          root:root         0755
  166. # turned off write and wall by disabling sgid tty:
  167. /usr/bin/wall                                           root:tty          0755
  168. /usr/bin/write                                          root:tty          0755
  169. # thttpd
  170. /usr/bin/makeweb                                        root:www          0750
  171. # yaps, pager software, accesses /dev/ttyS? . Disabled sgid uucp.
  172. /usr/bin/yaps                                           root:uucp         0755
  173. # scmxx, tool for mobile phone, accesses /dev/ttyS?
  174. # #66309
  175. /usr/bin/scmxx                                          root:uucp         0755
  176. # ncpfs tool: trusted only
  177. /usr/bin/nwsfind                                        root:trusted      0750
  178. /usr/bin/ncplogin                                       root:trusted      0750
  179. /usr/bin/ncpmap                                         root:trusted      0750
  180. # lpdfilter:
  181. # checks itself that only lp and root can call it
  182. /usr/lib/lpdfilter/bin/runlpr                           root:root         0755
  183. # pcmcia:
  184. # Needs setuid to eject cards (#100120)
  185. /sbin/pccardctl                                         root:trusted      0755
  186. # pcmcia-cardinfo:
  187. # for visual pcmcia status info. Needs setuid for creating device
  188. # files. It does that before initializing X
  189. /usr/X11R6/bin/cardinfo                                 root:root         0755
  190. # gnokii nokia cellphone software
  191. # #66209
  192. /usr/sbin/mgnokiidev                                    root:uucp          755
  193. # pcp, performance co-pilot
  194. # setuid root is used to write /var/log/pcp/NOTICES
  195. # #66205
  196. /usr/lib/pcp/pmpost                                     root:trusted      0755
  197. # mailman mailing list software
  198. # #66315
  199. /usr/lib/mailman/cgi-bin/admin                          root:mailman      0755
  200. /usr/lib/mailman/cgi-bin/admindb                        root:mailman      0755
  201. /usr/lib/mailman/cgi-bin/edithtml                       root:mailman      0755
  202. /usr/lib/mailman/cgi-bin/listinfo                       root:mailman      0755
  203. /usr/lib/mailman/cgi-bin/options                        root:mailman      0755
  204. /usr/lib/mailman/cgi-bin/private                        root:mailman      0755
  205. /usr/lib/mailman/cgi-bin/roster                         root:mailman      0755
  206. /usr/lib/mailman/cgi-bin/subscribe                      root:mailman      0755
  207. /usr/lib/mailman/cgi-bin/confirm                        root:mailman      0755
  208. /usr/lib/mailman/cgi-bin/create                         root:mailman      0755
  209. /usr/lib/mailman/cgi-bin/editarch                       root:mailman      0755
  210. /usr/lib/mailman/cgi-bin/rmlist                         root:mailman      0755
  211. /usr/lib/mailman/mail/mailman                           root:mailman      0755
  212.  
  213. # libgnomesu (#75823)
  214. /opt/gnome/lib/libgnomesu/gnomesu-pam-backend           root:root         0755
  215.  
  216. # control-center2 (#104993)
  217. /opt/gnome/sbin/change-passwd                           root:root         0755
  218.  
  219. #
  220. # cups (#66305)
  221. #
  222. /usr/bin/lppasswd                                       lp:sys            0755
  223.  
  224. #
  225. # networking (need root for the privileged socket)
  226. #
  227. /bin/ping                                               root:root         0755
  228. /bin/ping6                                              root:root         0755
  229. /usr/bin/bing                                           root:trusted      0755
  230. /usr/sbin/traceroute6                                   root:root         0755
  231. # mtr is linked against ncurses.
  232. /usr/sbin/mtr                                           root:dialout      0755
  233. /usr/bin/rcp                                            root:root         0755
  234. /usr/bin/rlogin                                         root:root         0755
  235. /usr/bin/rsh                                            root:root         0755
  236.  
  237. # OpenPBS #66320
  238. /var/spool/pbs/spool                                    root:root         0755
  239. /var/spool/pbs/undelivered                              root:root         0755
  240. /opt/pbs/sbin/pbs_iff                                   root:root         0755
  241. /opt/pbs/sbin/pbs_rcp                                   root:root         0755
  242.  
  243. # heartbeat #66310
  244. # cl_status needs to be allowed to connect to the heartbeat API. If the setgid
  245. # bit is removed, one can manually add users to the haclient group instead.
  246. /usr/bin/cl_status                                      root:haclient     0555
  247.  
  248. # apache2
  249. /usr/sbin/suexec2                                       root:root         0755
  250.  
  251. # exim
  252. /usr/sbin/exim                                          root:root         0755
  253.  
  254. #
  255. # dialup networking programs
  256. #
  257. /usr/sbin/pppoe-wrapper                                 root:dialout      0750
  258. # i4l package (#100750):
  259. /sbin/isdnctrl                                          root:dialout      0750
  260. # #66111
  261. /usr/bin/vboxbeep                                       root:trusted      0755
  262.  
  263.  
  264. #
  265. # linux text console utilities
  266. #
  267. # setuid needed on the text console to set the terminal content on ctrl-o
  268. # #66112
  269. /usr/lib/mc/cons.saver                                  root:root         0755
  270.  
  271.  
  272. #
  273. # terminal emulators
  274. # This and future SuSE products have support for the utempter, a small helper
  275. # program that does the utmp/wtmp update work with the necessary rights.
  276. # The use of utempter obsoletes the need for sgid bits on terminal emulator
  277. # binaries. We mention screen here, but all other terminal emulators have
  278. # moved to /etc/permissions, with modes set to 0755.
  279.  
  280. # framebuffer terminal emulator (japanese).
  281. /usr/bin/jfbterm                                        root:tty          0755
  282.  
  283. #
  284. # kde
  285. #
  286. # arts wrapper, normally suid root:
  287. /opt/kde3/bin/artswrapper                               root:root         0755
  288. # needs setuid root when using shadow via NIS:
  289. # #66218
  290. /opt/kde3/bin/kcheckpass                                root:shadow       0755
  291. # do not allow khc_indexbuilder to write into /var/cache/susehelp/
  292. /opt/kde3/bin/khc_indexbuilder                          root:man          0755
  293. # This has a meaning... hmm...
  294. /opt/kde3/bin/kdesud                                    root:nogroup      0755
  295. # used for getting proxy settings from dhcp
  296. /opt/kde3/bin/kpac_dhcp_helper                          root:root         0755
  297. # edits /etc/smb.conf
  298. # #66312
  299. /usr/bin/fileshareset                                   root:root         0755
  300.  
  301.  
  302. #
  303. # amanda
  304. #
  305. # Well, if you are gid disk already, you don't need these amanda binaries
  306. # to get root.
  307. # Anyway, we don't keep the suid bits.
  308. /usr/sbin/amcheck                                       root:disk         0750
  309. /usr/lib/amanda/calcsize                                root:disk         0750
  310. /usr/lib/amanda/rundump                                 root:disk         0750
  311. /usr/lib/amanda/planner                                 root:disk         0750
  312. /usr/lib/amanda/runtar                                  root:disk         0750
  313. /usr/lib/amanda/dumper                                  root:disk         0750
  314. /usr/lib/amanda/killpgrp                                root:disk         0750
  315.  
  316.  
  317. #
  318. # gnats
  319. #
  320. /usr/lib/gnats/gen-index                                gnats:root        0555
  321. /usr/lib/gnats/pr-edit                                  gnats:root        0555
  322. /usr/lib/gnats/queue-pr                                 gnats:root        0555
  323.  
  324.  
  325. #
  326. # news (inn)
  327. #
  328. # the inn start script changes it's uid to news:news. Later innstart and
  329. # innfeed are called by this user. Those programs do not need to be called by
  330. # anyone else, therefore the strange permissions 4554 are required for
  331. # operation. (#67032)
  332. #
  333. /usr/lib/news/bin/rnews                                 news:uucp         0555
  334. /usr/lib/news/bin/startinnfeed                          root:news         0555
  335. /usr/lib/news/bin/inndstart                             root:news         0555
  336. /usr/lib/news/bin/inews                                 news:news         0555
  337.  
  338.  
  339. #
  340. # fax
  341. #
  342. # restrictive, only for "trusted" group users:
  343. # faxq helper:
  344. /usr/lib/mgetty+sendfax/faxq-helper                     fax:root          0711
  345. /var/spool/fax/outgoing                                 fax:trusted       1770
  346. /var/spool/fax/outgoing/locks                           fax:trusted       1770
  347. # TODO: package should set this permissions
  348. /var/spool/fax/archive                                  fax:uucp           700
  349. /var/spool/fax/bin                                      fax:uucp           755
  350. /var/spool/fax/client                                   fax:uucp           755
  351. /var/spool/fax/config                                   fax:uucp           755
  352. /var/spool/fax/dev                                      fax:uucp           755
  353. /var/spool/fax/docq                                     fax:uucp           700
  354. /var/spool/fax/doneq                                    fax:uucp           700
  355. /var/spool/fax/etc                                      fax:uucp           755
  356. /var/spool/fax/info                                     fax:uucp           755
  357. /var/spool/fax/log                                      fax:uucp           755
  358. /var/spool/fax/pollq                                    fax:uucp           700
  359. /var/spool/fax/recvq                                    fax:uucp           755
  360. /var/spool/fax/sendq                                    fax:uucp           700
  361. /var/spool/fax/status                                   fax:uucp           755
  362. /var/spool/fax/tmp                                      fax:uucp           700
  363.  
  364. #
  365. # uucp
  366. #
  367. /var/spool/uucppublic                                   root:uucp         1770
  368. /usr/bin/uucp                                           uucp:uucp         0555
  369. /usr/bin/uuname                                         uucp:uucp         0555
  370. /usr/bin/uustat                                         uucp:uucp         0555
  371. /usr/bin/uux                                            uucp:uucp         0555
  372. /usr/lib/uucp/uucico                                    uucp:uucp         0555
  373. /usr/lib/uucp/uuxqt                                     uucp:uucp         0555
  374.  
  375.  
  376. #
  377. # games of all kinds, toys
  378. #
  379.  
  380. # bsd-games
  381. /usr/games/atc                                          games:games       0755
  382. /usr/games/battlestar                                   games:games       0755
  383. /usr/games/canfield                                     games:games       0755
  384. /usr/games/cribbage                                     games:games       0755
  385. /usr/games/phantasia                                    games:games       0755
  386. /usr/games/robots                                       games:games       0755
  387. /usr/games/sail                                         games:games       0755
  388. /usr/games/snake                                        games:games       0755
  389. /usr/games/tetris-bsd                                   games:games       0755
  390.  
  391. # Maelstrom
  392. /usr/games/Maelstrom                                    games:games       0755
  393.  
  394. # pachi
  395. /usr/games/pachi                                        games:games       0755
  396. /usr/games/martian                                      games:games       0755
  397.  
  398. # nethack
  399. /usr/lib/nethack/nethack.tty                            games:games       0755
  400.  
  401. # chromium,
  402. /usr/games/chromium                                     games:games       0755
  403.  
  404. # geki2
  405. /usr/games/geki2                                        games:games       0755
  406. /usr/games/grande                                       games:games       0755
  407.  
  408. # xscrabble
  409. /usr/games/xscrab                                       games:games       0755
  410.  
  411. # trackballs
  412. /usr/games/trackballs                                   games:games       0755
  413.  
  414. # ltris
  415. /usr/games/ltris                                        games:games       0755
  416.  
  417. # xlogical
  418. /usr/games/xlogical                                     games:games       0755
  419.  
  420. # lbreakout
  421. /usr/games/lbreakout2                                   games:games       0755
  422.  
  423. # xgalaga
  424. /usr/X11R6/bin/xgalaga                                  games:games       0755
  425.  
  426. # xtetris
  427. /usr/X11R6/bin/xtetris                                  games:games       0755
  428.  
  429. # xmris
  430. /usr/X11R6/bin/xmris                                    games:games       0755
  431.  
  432. # rocksndiamonds
  433. /usr/games/rocksndiamonds                               games:games       0755
  434.  
  435. # gnome-games
  436. /opt/gnome/bin/gtali                                    games:games       0755
  437. /opt/gnome/bin/gnotski                                  games:games       0755
  438. /opt/gnome/bin/gnome-stones                             games:games       0755
  439. /opt/gnome/bin/glines                                   games:games       0755
  440. /opt/gnome/bin/gnibbles                                 games:games       0755
  441. /opt/gnome/bin/gnotravex                                games:games       0755
  442. /opt/gnome/bin/mahjongg                                 games:games       0755
  443. /opt/gnome/bin/gnometris                                games:games       0755
  444. /opt/gnome/bin/gnobots2                                 games:games       0755
  445. /opt/gnome/bin/gnomine                                  games:games       0755
  446. /opt/gnome/bin/same-gnome                               games:games       0755
  447.  
  448. # Novell nici. See bug 127545
  449. /var/opt/novell/nici/nicimud                            root:root         0755
  450.