home *** CD-ROM | disk | FTP | other *** search
/ chilidog.highland.cc.ks.us / chilidog.highland.cc.ks.us.zip / chilidog.highland.cc.ks.us / backup / bradford.20120521.etc.tar.gz / bradford.20120521.etc.tar / etc / permissions.easy < prev    next >
Text File  |  2006-04-22  |  21KB  |  429 lines
  1. #
  2. # Copyright (c) 2001 SuSE GmbH Nuernberg, Germany.  All rights reserved.
  3. #
  4. # Author: Roman Drahtmueller <draht@suse.de>, 2001
  5. #
  6. # 
  7. # See /etc/permissions for general hints on how to use this file.
  8. #
  9. # /etc/permissions.easy is set up for the use in a standalone and single-user
  10. # installation to make things "work" out-of-the box.
  11. # Some of the settings might be considered somewhat lax from the security
  12. # standpoint. These aspects are handled differently in the permissions.secure
  13. # file.
  14. # 
  15.  
  16. #
  17. # Directories
  18. #
  19.  
  20. # lock file for emacs
  21. /var/lib/xemacs/lock                                    root:root         1777
  22. # for screen's session sockets:
  23. /var/run/uscreens                                       root:root         1777
  24.  
  25. #
  26. # /etc
  27. #
  28. /etc/crontab                                            root:root          644
  29. /etc/exports                                            root:root          644
  30. /etc/fstab                                              root:root          644
  31. # we don't package it
  32. /etc/ftpaccess                                          root:root          644
  33. /etc/ftpusers                                           root:root          644
  34. /etc/inetd.conf                                         root:root          644
  35. /etc/inittab                                            root:root          644
  36. /etc/mtab                                               root:root          644
  37. /etc/rmtab                                              root:root          644
  38. /var/lib/nfs/rmtab                                      root:root          644
  39. /etc/syslog.conf                                        root:root          644
  40.  
  41. #
  42. # suid system programs that need the suid bit to work:
  43. #
  44. /bin/su                                                 root:root         4755
  45. /usr/bin/at                                             root:trusted      4755
  46. /usr/bin/crontab                                        root:trusted      4755
  47. /usr/bin/gpasswd                                        root:shadow       4755
  48. /usr/bin/newgrp                                         root:root         4755
  49. /usr/bin/passwd                                         root:shadow       4755
  50. /usr/bin/chfn                                           root:shadow       4755
  51. /usr/bin/chage                                          root:shadow       4755
  52. /usr/bin/chsh                                           root:shadow       4755
  53. /usr/bin/expiry                                         root:shadow       4755
  54. # the default configuration of the sudo package in SuSE distribution is to
  55. # intimidate users.
  56. /usr/bin/sudo                                           root:root         4755
  57. /usr/sbin/su-wrapper                                    root:root         4755
  58. # opie password system
  59. # #66303
  60. /usr/bin/opiepasswd                                     root:root         4755
  61. /usr/bin/opiesu                                         root:root         4755
  62. # "user" entries in /etc/fstab make mount work for non-root users:
  63. /usr/bin/ncpmount                                       root:trusted      4750
  64. /usr/bin/ncpumount                                      root:trusted      4750
  65. # mount/umount have had their problems already:
  66. /bin/mount                                              root:root         4755
  67. /bin/umount                                             root:root         4755
  68. /bin/eject                                              root:audio        4755
  69. #
  70. # #133657
  71. /usr/bin/fusermount                                     root:trusted      4755
  72. # #66203
  73. /usr/lib/majordomo/wrapper                              root:daemon       4755
  74. # glibc backwards compatibility
  75. /usr/lib/pt_chown                                       root:root         4755
  76. /usr/lib64/pt_chown                                     root:root         4755
  77. /sbin/unix_chkpwd                                       root:shadow       2755
  78. /sbin/unix2_chkpwd                                      root:shadow       2755
  79. # qpopper
  80. /usr/sbin/popauth                                       pop:trusted       4755
  81. # from the squid package
  82. /usr/sbin/pam_auth                                      root:shadow       2755
  83.  
  84. # still to be converted to utempter
  85. /opt/gnome/lib/vte/gnome-pty-helper                     root:tty          2755
  86.  
  87. # gpg cannot pin memory into the ram using mlock(2) if not suid.
  88. # In memory pressure conditions, memory pages containing sensitive information
  89. # can be paged to disk.
  90. # the suid bit also removes gpg's complaints wrt the insecure memory.
  91. /usr/bin/gpg                                            root:root         4755
  92.  
  93. #
  94. # mixed section:
  95. #
  96. #########################################################################
  97. # rpm subsystem:
  98. /usr/src/packages/SOURCES/                              root:root         1777
  99. /usr/src/packages/BUILD/                                root:root         1777
  100. /usr/src/packages/RPMS/                                 root:root         1777
  101. /usr/src/packages/RPMS/alpha/                           root:root         1777
  102. /usr/src/packages/RPMS/alphaev56/                       root:root         1777
  103. /usr/src/packages/RPMS/alphaev67/                       root:root         1777
  104. /usr/src/packages/RPMS/alphaev6/                        root:root         1777
  105. /usr/src/packages/RPMS/arm4l/                           root:root         1777
  106. /usr/src/packages/RPMS/athlon/                          root:root         1777
  107. /usr/src/packages/RPMS/i386/                            root:root         1777
  108. /usr/src/packages/RPMS/i486/                            root:root         1777
  109. /usr/src/packages/RPMS/i586/                            root:root         1777
  110. /usr/src/packages/RPMS/i686/                            root:root         1777
  111. /usr/src/packages/RPMS/ia64/                            root:root         1777
  112. /usr/src/packages/RPMS/mips/                            root:root         1777
  113. /usr/src/packages/RPMS/ppc/                             root:root         1777
  114. /usr/src/packages/RPMS/ppc64/                           root:root         1777
  115. /usr/src/packages/RPMS/powerpc/                         root:root         1777
  116. /usr/src/packages/RPMS/powerpc64/                       root:root         1777
  117. /usr/src/packages/RPMS/s390/                            root:root         1777
  118. /usr/src/packages/RPMS/s390x/                           root:root         1777
  119. /usr/src/packages/RPMS/sparc/                           root:root         1777
  120. /usr/src/packages/RPMS/sparcv9/                         root:root         1777
  121. /usr/src/packages/RPMS/sparc64/                         root:root         1777
  122. /usr/src/packages/RPMS/x86_64/                          root:root         1777
  123. /usr/src/packages/RPMS/armv4l/                          root:root         1777
  124. /usr/src/packages/RPMS/hppa/                            root:root         1777
  125. /usr/src/packages/RPMS/hppa2.0/                         root:root         1777
  126. /usr/src/packages/RPMS/noarch/                          root:root         1777
  127. /usr/src/packages/SPECS/                                root:root         1777
  128. /usr/src/packages/SRPMS/                                root:root         1777
  129. #########################################################################
  130. # video
  131. /usr/X11R6/bin/v4l-conf                                 root:video        4755
  132. /opt/gnome/sbin/zapping_setup_fb                        root:video        4755
  133. # vmware
  134. /usr/bin/vmware                                         root:trusted      4755
  135. /usr/bin/vmware-ping                                    root:trusted      4755
  136. # Itanium ia32 emulator
  137. /usr/lib/ia32el/suid_ia32x_loader                       root:root         4755
  138. # scotty:
  139. # #66211
  140. /usr/bin/ntping                                         root:trusted      4750
  141. # screen savers:
  142. /usr/bin/vlock                                          root:shadow       2755
  143. /usr/X11R6/bin/Xorg                                     root:root         4711
  144. /usr/bin/man                                            root:root         4755
  145. /usr/bin/mandb                                          root:root         4755
  146. # turn off write and wall by disabling sgid tty:
  147. /usr/bin/wall                                           root:tty          2755
  148. /usr/bin/write                                          root:tty          2755
  149. # thttpd:
  150. /usr/bin/makeweb                                        root:www          2755
  151. # yaps, pager software, accesses /dev/ttyS?
  152. /usr/bin/yaps                                           root:uucp         2755
  153. # scmxx, tool for mobile phone, accesses /dev/ttyS?
  154. # #66309
  155. /usr/bin/scmxx                                          root:uucp         2755
  156. # ncpfs tool
  157. /usr/bin/nwsfind                                        root:trusted      4750
  158. /usr/bin/ncplogin                                       root:trusted      4750
  159. /usr/bin/ncpmap                                         root:trusted      4750
  160. # lpdfilter:
  161. # checks itself that only lp and root can call it
  162. /usr/lib/lpdfilter/bin/runlpr                           root:root         4755
  163. # pcmcia:
  164. # Needs setuid to eject cards (#100120)
  165. /sbin/pccardctl                                         root:trusted      4755
  166. # pcmcia-cardinfo:
  167. # for visual pcmcia status info. Needs setuid for creating device files. It
  168. # does that before initializing X
  169. /usr/X11R6/bin/cardinfo                                 root:root         4755
  170. # gnokii nokia cellphone software
  171. # #66209
  172. /usr/sbin/mgnokiidev                                    root:uucp         4755
  173. # pcp, performance co-pilot
  174. # setuid root is used to write /var/log/pcp/NOTICES
  175. # #66205
  176. /usr/lib/pcp/pmpost                                     root:root         4755
  177. # mailman mailing list software
  178. # #66315
  179. /usr/lib/mailman/cgi-bin/admin                          root:mailman      2755
  180. /usr/lib/mailman/cgi-bin/admindb                        root:mailman      2755
  181. /usr/lib/mailman/cgi-bin/edithtml                       root:mailman      2755
  182. /usr/lib/mailman/cgi-bin/listinfo                       root:mailman      2755
  183. /usr/lib/mailman/cgi-bin/options                        root:mailman      2755
  184. /usr/lib/mailman/cgi-bin/private                        root:mailman      2755
  185. /usr/lib/mailman/cgi-bin/roster                         root:mailman      2755
  186. /usr/lib/mailman/cgi-bin/subscribe                      root:mailman      2755
  187. /usr/lib/mailman/cgi-bin/confirm                        root:mailman      2755
  188. /usr/lib/mailman/cgi-bin/create                         root:mailman      2755
  189. /usr/lib/mailman/cgi-bin/editarch                       root:mailman      2755
  190. /usr/lib/mailman/cgi-bin/rmlist                         root:mailman      2755
  191. /usr/lib/mailman/mail/mailman                           root:mailman      2755
  192.  
  193. # libgnomesu (#75823)
  194. /opt/gnome/lib/libgnomesu/gnomesu-pam-backend           root:root         4755
  195.  
  196. # control-center2 (#104993)
  197. /opt/gnome/sbin/change-passwd                           root:root         4755
  198.  
  199. #
  200. # cups (#66305)
  201. #
  202. /usr/bin/lppasswd                                       lp:sys            4755
  203.  
  204. #
  205. # networking (need root for the privileged socket)
  206. #
  207. /bin/ping                                               root:root         4755
  208. /bin/ping6                                              root:root         4755
  209. /usr/bin/bing                                           root:trusted      4755
  210. /usr/sbin/traceroute6                                   root:root         4755
  211. # mtr is linked against ncurses. For dialout only.
  212. /usr/sbin/mtr                                           root:dialout      4750
  213. /usr/bin/rcp                                            root:root         4755
  214. /usr/bin/rlogin                                         root:root         4755
  215. /usr/bin/rsh                                            root:root         4755
  216.  
  217. # OpenPBS #66320
  218. /var/spool/pbs/spool                                    root:root         1777
  219. /var/spool/pbs/undelivered                              root:root         1777
  220. /opt/pbs/sbin/pbs_iff                                   root:root         4755
  221. /opt/pbs/sbin/pbs_rcp                                   root:root         4755
  222.  
  223. # heartbeat #66310
  224. # cl_status needs to be allowed to connect to the heartbeat API. If the setgid
  225. # bit is removed, one can manually add users to the haclient group instead.
  226. /usr/bin/cl_status                                      root:haclient     2555
  227.  
  228. # apache2
  229. /usr/sbin/suexec2                                       root:root         4755
  230.  
  231. # exim
  232. /usr/sbin/exim                                          root:root         4755
  233.  
  234. #
  235. # dialup networking programs
  236. #
  237. /usr/sbin/pppoe-wrapper                                 root:dialout      4750
  238. # i4l package (#100750):
  239. /sbin/isdnctrl                                          root:dialout      4750
  240. # #66111
  241. /usr/bin/vboxbeep                                       root:trusted      4755
  242.  
  243.  
  244. #
  245. # linux text console utilities
  246. #
  247. # setuid needed on the text console to set the terminal content on ctrl-o
  248. # #66112
  249. /usr/lib/mc/cons.saver                                  root:root         4755
  250.  
  251.  
  252. #
  253. # terminal emulators
  254. # This and future SuSE products have support for the utempter, a small helper
  255. # program that does the utmp/wtmp update work with the necessary rights.
  256. # The use of utempter obsoletes the need for sgid bits on terminal emulator
  257. # binaries. We mention screen here, but all other terminal emulators have
  258. # moved to /etc/permissions, with modes set to 0755.
  259.  
  260. # needs setuid to access /dev/console
  261. # framebuffer terminal emulator (japanese)
  262. /usr/bin/jfbterm                                        root:tty          6755
  263.  
  264. #
  265. # kde
  266. # (all of them are disabled in permissions.secure except for 
  267. # the helper programs)
  268. #
  269. # arts wrapper, normally suid root:
  270. /opt/kde3/bin/artswrapper                               root:root         4755
  271. # needs setuid root when using shadow via NIS:
  272. # #66218
  273. /opt/kde3/bin/kcheckpass                                root:shadow       4755
  274. # allow khc_indexbuilder to write into /var/cache/susehelp/
  275. /opt/kde3/bin/khc_indexbuilder                          root:man          2755
  276. # This has a meaning... hmm...
  277. /opt/kde3/bin/kdesud                                    root:nogroup      2755
  278. # used for getting proxy settings from dhcp
  279. /opt/kde3/bin/kpac_dhcp_helper                          root:root         4755
  280. # edits /etc/smb.conf
  281. # #66312
  282. /usr/bin/fileshareset                                   root:root         4755
  283.  
  284.  
  285. #
  286. # amanda
  287. #
  288. /usr/sbin/amcheck                                       root:disk         4750
  289. /usr/lib/amanda/calcsize                                root:disk         4750
  290. /usr/lib/amanda/rundump                                 root:disk         4750
  291. /usr/lib/amanda/planner                                 root:disk         4750
  292. /usr/lib/amanda/runtar                                  root:disk         4750
  293. /usr/lib/amanda/dumper                                  root:disk         4750
  294. /usr/lib/amanda/killpgrp                                root:disk         4750
  295.  
  296.  
  297. #
  298. # gnats
  299. #
  300. /usr/lib/gnats/gen-index                                gnats:root        4555
  301. /usr/lib/gnats/pr-edit                                  gnats:root        4555
  302. /usr/lib/gnats/queue-pr                                 gnats:root        4555
  303.  
  304.  
  305. #
  306. # news (inn)
  307. #
  308. # the inn start script changes it's uid to news:news. Later innstart and
  309. # innfeed are called by this user. Those programs do not need to be called by
  310. # anyone else, therefore the strange permissions 4554 are required for
  311. # operation. (#67032)
  312. #
  313. /usr/lib/news/bin/rnews                                 news:uucp         4550
  314. /usr/lib/news/bin/startinnfeed                          root:news         4554
  315. /usr/lib/news/bin/inndstart                             root:news         4554
  316. /usr/lib/news/bin/inews                                 news:news         2555
  317.  
  318.  
  319. #
  320. # fax
  321. #
  322. # faxq helper:
  323. /usr/lib/mgetty+sendfax/faxq-helper                     fax:root          4711
  324. /var/spool/fax/outgoing                                 fax:root          1755
  325. /var/spool/fax/outgoing/locks                           fax:root          0777
  326. # TODO: package should set this permissions
  327. /var/spool/fax/archive                                  fax:uucp           700
  328. /var/spool/fax/bin                                      fax:uucp           755
  329. /var/spool/fax/client                                   fax:uucp           755
  330. /var/spool/fax/config                                   fax:uucp           755
  331. /var/spool/fax/dev                                      fax:uucp           755
  332. /var/spool/fax/docq                                     fax:uucp           700
  333. /var/spool/fax/doneq                                    fax:uucp           700
  334. /var/spool/fax/etc                                      fax:uucp           755
  335. /var/spool/fax/info                                     fax:uucp           755
  336. /var/spool/fax/log                                      fax:uucp           755
  337. /var/spool/fax/pollq                                    fax:uucp           700
  338. /var/spool/fax/recvq                                    fax:uucp           755
  339. /var/spool/fax/sendq                                    fax:uucp           700
  340. /var/spool/fax/status                                   fax:uucp           755
  341. /var/spool/fax/tmp                                      fax:uucp           700
  342.  
  343. #
  344. # uucp
  345. #
  346. /var/spool/uucppublic                                   root:root         1777
  347. /usr/bin/uucp                                           uucp:uucp         6555
  348. /usr/bin/uuname                                         uucp:uucp         6555
  349. /usr/bin/uustat                                         uucp:uucp         6555
  350. /usr/bin/uux                                            uucp:uucp         6555
  351. /usr/lib/uucp/uucico                                    uucp:uucp         6555
  352. /usr/lib/uucp/uuxqt                                     uucp:uucp         6555
  353.  
  354.  
  355. #
  356. # games of all kinds, toys
  357. #
  358.  
  359. # bsd-games
  360. /usr/games/atc                                          games:games       2755
  361. /usr/games/battlestar                                   games:games       2755
  362. /usr/games/canfield                                     games:games       2755
  363. /usr/games/cribbage                                     games:games       2755
  364. /usr/games/phantasia                                    games:games       2755
  365. /usr/games/robots                                       games:games       2755
  366. /usr/games/sail                                         games:games       2755
  367. /usr/games/snake                                        games:games       2755
  368. /usr/games/tetris-bsd                                   games:games       2755
  369.  
  370. # Maelstrom
  371. /usr/games/Maelstrom                                    games:games       2755
  372.  
  373. # pachi
  374. /usr/games/pachi                                        games:games       2755
  375. /usr/games/martian                                      games:games       2755
  376.  
  377. # nethack
  378. /usr/lib/nethack/nethack.tty                            games:games       2755
  379.  
  380. # chromium,
  381. /usr/games/chromium                                     games:games       2755
  382.  
  383. # geki2
  384. /usr/games/geki2                                        games:games       2755
  385. /usr/games/grande                                       games:games       2755
  386.  
  387. # xscrabble
  388. /usr/games/xscrab                                       games:games       2755
  389.  
  390. # trackballs
  391. /usr/games/trackballs                                   games:games       2755
  392.  
  393. # ltris
  394. /usr/games/ltris                                        games:games       2755
  395.  
  396. # xlogical
  397. /usr/games/xlogical                                     games:games       2755
  398.  
  399. # lbreakout
  400. /usr/games/lbreakout2                                   games:games       2755
  401.  
  402. # xgalaga
  403. /usr/X11R6/bin/xgalaga                                  games:games       2755
  404.  
  405. # xtetris
  406. /usr/X11R6/bin/xtetris                                  games:games       2755
  407.  
  408. # xmris
  409. /usr/X11R6/bin/xmris                                    games:games       2755
  410.  
  411. # rocksndiamonds
  412. /usr/games/rocksndiamonds                               games:games       2755
  413.  
  414. # gnome-games
  415. /opt/gnome/bin/gtali                                    games:games       2755
  416. /opt/gnome/bin/gnotski                                  games:games       2755
  417. /opt/gnome/bin/gnome-stones                             games:games       2755
  418. /opt/gnome/bin/glines                                   games:games       2755
  419. /opt/gnome/bin/gnibbles                                 games:games       2755
  420. /opt/gnome/bin/gnotravex                                games:games       2755
  421. /opt/gnome/bin/mahjongg                                 games:games       2755
  422. /opt/gnome/bin/gnometris                                games:games       2755
  423. /opt/gnome/bin/gnobots2                                 games:games       2755
  424. /opt/gnome/bin/gnomine                                  games:games       2755
  425. /opt/gnome/bin/same-gnome                               games:games       2755
  426.  
  427. # Novell nici. See bug 127545
  428. /var/opt/novell/nici/nicimud                            root:root         4755
  429.