home *** CD-ROM | disk | FTP | other *** search
/ chilidog.highland.cc.ks.us / chilidog.highland.cc.ks.us.zip / chilidog.highland.cc.ks.us / backup / bradford.20120521.etc.tar.gz / bradford.20120521.etc.tar / etc / permissions.secure < prev    next >
Text File  |  2006-04-22  |  24KB  |  474 lines
  1. # /etc/permissions.secure
  2. #
  3. # Copyright (c) 2001 SuSE GmbH Nuernberg, Germany.  All rights reserved.
  4. #
  5. # Author: Roman Drahtmueller <draht@suse.de>, 2001
  6. #
  7. # 
  8. # See /etc/permissions for general hints on how to use this file.
  9. #
  10. # /etc/permissions.secure is designed for the use in a multi-user and
  11. # networked installation. Most privileged file modes are disabled here.
  12. # Many programs that still have their suid- or sgid-modes have had their
  13. # security problems in the past already.
  14. # The primary target of this configuration is to make the basic things
  15. # such as changing passwords, the basic networking programs as well as
  16. # some of the all-day work programs properly function for the unprivileged
  17. # user. The dial-out packages are executable for users belonging to the
  18. # "dialout" group - therefore, these users are to be treated "privileged".
  19. # Packages such as (remote-) batch queueing systems, games, programs for 
  20. # the linux text console, everything linked against OOP libraries and
  21. # most other exotic utilities are turned into unprivileged binary files
  22. # in order for them not to cause any security problems if one or more of
  23. # the programs turn out to have buffer overruns or otherwise locally 
  24. # exploitable programming errors.
  25. # This file is not designed to make your system as closed and as restrictive
  26. # as at all possible. In many cases, restricted access to a configuration 
  27. # file is of no use since the data used can be obtained from the /proc file
  28. # system or interface configuration as well. Also, system programs such as
  29. # /sbin/ifconfig or /sbin/route are not changed because nosey users can
  30. # bring their own. "Security by obscurity" will add any significant 
  31. # security-related advantage to the system. Keep in mind that curiosity
  32. # is a major motivation for your users to try to see behind the curtain.
  33. #
  34. # If you need the functionality of a program that usually runs as a
  35. # privileged user, then use it as root, or, if you are not root, ask your 
  36. # system administrator for advice. In many cases, adding a user to the 
  37. # "trusted" group gives her access to the resources that are not accessible
  38. # any more if the admin chose to select "secure" as the permissions default.
  39. #
  40. # Please make use of the diff program to see the differences between the
  41. # permissions.easy and permissions.secure files if things don't work as
  42. # they should and you suspect a permission or privilege problem.
  43. # The word "easy" is a reference for the /etc/permissions.easy file.
  44. #
  45. # As usual, these settings are "suggested". If you feel so inclined, 
  46. # please feel free to change the modes in this files, but keep a log 
  47. # of your changes for future reference.
  48.  
  49. # Please always keep in mind that your system listens on network sockets
  50. # in the default configuration. Change this by disabling the services that 
  51. # you do not need or by restricting access to them using packet filters
  52. # or tcp wrappers (see hosts_access(5)) to gain a higher level of security
  53. # in your system.
  54.  
  55. #
  56. # Directories
  57. #
  58. # no lock files for emacs:
  59. /var/lib/xemacs/lock                                    root:trusted      1775
  60. # for screen's session sockets:
  61. /var/run/uscreens                                       root:root         1777
  62.  
  63. #
  64. # /etc
  65. #
  66. /etc/crontab                                            root:root          600
  67. /etc/exports                                            root:root          644
  68. /etc/fstab                                              root:root          644
  69. /etc/ftpaccess                                          root:root          644
  70. /etc/ftpusers                                           root:root          644
  71. /etc/inetd.conf                                         root:root          644
  72. /etc/inittab                                            root:root          644
  73. /etc/mtab                                               root:root          644
  74. /etc/rmtab                                              root:root          644
  75. /var/lib/nfs/rmtab                                      root:root          644
  76. /etc/syslog.conf                                        root:root          600
  77.  
  78. #
  79. # suid system programs that need the suid bit to work:
  80. #
  81. /bin/su                                                 root:root         4755
  82. # disable at and cron for users that do not belnong to the group "trusted"
  83. /usr/bin/at                                             root:trusted      4750
  84. /usr/bin/crontab                                        root:trusted      4750
  85. /usr/bin/gpasswd                                        root:shadow       4755
  86. /usr/bin/newgrp                                         root:root         4755
  87. /usr/bin/passwd                                         root:shadow       4755
  88. /usr/bin/chfn                                           root:shadow       4755
  89. /usr/bin/chage                                          root:shadow       4755
  90. /usr/bin/chsh                                           root:shadow       4755
  91. /usr/bin/expiry                                         root:shadow       4755
  92. # the default configuration of the sudo package in SuSE distribution is to
  93. # intimidate users.
  94. /usr/bin/sudo                                           root:root         4755
  95. /usr/sbin/su-wrapper                                    root:root         0755
  96. # opie password system
  97. # #66303
  98. /usr/bin/opiepasswd                                     root:root         4755
  99. /usr/bin/opiesu                                         root:root         4755
  100. # "user" entries in /etc/fstab make mount work for non-root users:
  101. /usr/bin/ncpmount                                       root:trusted      4750
  102. /usr/bin/ncpumount                                      root:trusted      4750
  103. # mount/umount have had their problems already:
  104. /bin/mount                                              root:root         4755
  105. /bin/umount                                             root:root         4755
  106. /bin/eject                                              root:audio        4750
  107. #
  108. # #133657
  109. /usr/bin/fusermount                                     root:trusted      4750
  110. # #66203
  111. /usr/lib/majordomo/wrapper                              root:daemon       4750
  112. # glibc backwards compatibility
  113. /usr/lib/pt_chown                                       root:root         4755
  114. /usr/lib64/pt_chown                                     root:root         4755
  115. /sbin/unix_chkpwd                                       root:shadow       2755
  116. /sbin/unix2_chkpwd                                      root:shadow       2755
  117. # qpopper
  118. /usr/sbin/popauth                                       pop:trusted       4750
  119. # from the squid package
  120. /usr/sbin/pam_auth                                      root:shadow       2755
  121.  
  122. # still to be converted to utempter
  123. /opt/gnome/lib/vte/gnome-pty-helper                     root:tty          2755
  124.  
  125. # gpg cannot pin memory into the ram using mlock(2) if not suid.
  126. # In memory pressure conditions, memory pages containing sensitive information
  127. # can be paged to disk.
  128. # the suid bit also removes gpg's complaints wrt the insecure memory.
  129. /usr/bin/gpg                                            root:root         4755
  130.  
  131.  
  132.  
  133.  
  134. #
  135. # mixed section: most of it is disabled in this permissions.secure:
  136. #
  137. #########################################################################
  138. # rpm subsystem:
  139. /usr/src/packages/SOURCES/                              root:root          755
  140. /usr/src/packages/BUILD/                                root:root          755
  141. /usr/src/packages/RPMS/                                 root:root          755
  142. /usr/src/packages/RPMS/alpha/                           root:root          755
  143. /usr/src/packages/RPMS/alphaev56/                       root:root          755
  144. /usr/src/packages/RPMS/alphaev67/                       root:root          755
  145. /usr/src/packages/RPMS/alphaev6/                        root:root          755
  146. /usr/src/packages/RPMS/arm4l/                           root:root          755
  147. /usr/src/packages/RPMS/athlon/                          root:root          755
  148. /usr/src/packages/RPMS/i386/                            root:root          755
  149. /usr/src/packages/RPMS/i486/                            root:root          755
  150. /usr/src/packages/RPMS/i586/                            root:root          755
  151. /usr/src/packages/RPMS/i686/                            root:root          755
  152. /usr/src/packages/RPMS/ia64/                            root:root          755
  153. /usr/src/packages/RPMS/mips/                            root:root          755
  154. /usr/src/packages/RPMS/ppc/                             root:root          755
  155. /usr/src/packages/RPMS/ppc64/                           root:root          755
  156. /usr/src/packages/RPMS/powerpc/                         root:root          755
  157. /usr/src/packages/RPMS/powerpc64/                       root:root          755
  158. /usr/src/packages/RPMS/s390/                            root:root          755
  159. /usr/src/packages/RPMS/s390x/                           root:root          755
  160. /usr/src/packages/RPMS/sparc/                           root:root          755
  161. /usr/src/packages/RPMS/sparcv9/                         root:root          755
  162. /usr/src/packages/RPMS/sparc64/                         root:root          755
  163. /usr/src/packages/RPMS/x86_64/                          root:root          755
  164. /usr/src/packages/RPMS/armv4l/                          root:root          755
  165. /usr/src/packages/RPMS/hppa/                            root:root          755
  166. /usr/src/packages/RPMS/hppa2.0/                         root:root          755
  167. /usr/src/packages/RPMS/noarch/                          root:root          755
  168. /usr/src/packages/SPECS/                                root:root          755
  169. /usr/src/packages/SRPMS/                                root:root          755
  170. #########################################################################
  171. # video
  172. /usr/X11R6/bin/v4l-conf                                 root:video        4750
  173. /opt/gnome/sbin/zapping_setup_fb                        root:video        4750
  174. # vmware
  175. /usr/bin/vmware                                         root:trusted      4750
  176. /usr/bin/vmware-ping                                    root:trusted      4750
  177. # Itanium ia32 emulator
  178. /usr/lib/ia32el/suid_ia32x_loader                       root:root         0755
  179. # scotty:
  180. # #66211
  181. /usr/bin/ntping                                         root:trusted      4750
  182. # This is not extensively tested.
  183. /usr/bin/vlock                                          root:shadow       0755
  184. /usr/X11R6/bin/Xorg                                     root:root         0711
  185. /usr/bin/man                                            root:root         4755
  186. /usr/bin/mandb                                          root:root         4755
  187. # turned off write and wall by disabling sgid tty:
  188. /usr/bin/wall                                           root:tty          0755
  189. /usr/bin/write                                          root:tty          0755
  190. # thttpd: sgid + executeable only for group www. Useless...
  191. /usr/bin/makeweb                                        root:www          2750
  192. # yaps, pager software, accesses /dev/ttyS? . Disabled sgid uucp.
  193. /usr/bin/yaps                                           root:uucp         0755
  194. # scmxx, tool for mobile phone, accesses /dev/ttyS?
  195. # #66309
  196. /usr/bin/scmxx                                          root:uucp         0755
  197. # ncpfs tool: trusted only
  198. /usr/bin/nwsfind                                        root:trusted      4750
  199. /usr/bin/ncplogin                                       root:trusted      4750
  200. /usr/bin/ncpmap                                         root:trusted      4750
  201. # lpdfilter:
  202. # checks itself that only lp and root can call it
  203. /usr/lib/lpdfilter/bin/runlpr                           root:root         4755
  204. # pcmcia:
  205. # Needs setuid to eject cards (#100120)
  206. /sbin/pccardctl                                         root:trusted      4750
  207. # pcmcia-cardinfo:
  208. # for visual pcmcia status info. Needs setuid for creating device
  209. # files. It does that before initializing X
  210. /usr/X11R6/bin/cardinfo                                 root:root         0755
  211. # gnokii nokia cellphone software
  212. # #66209
  213. /usr/sbin/mgnokiidev                                    root:uucp          755
  214. # pcp, performance co-pilot
  215. # setuid root is used to write /var/log/pcp/NOTICES
  216. # #66205
  217. /usr/lib/pcp/pmpost                                     root:trusted      4750
  218. # mailman mailing list software
  219. # #66315
  220. /usr/lib/mailman/cgi-bin/admin                          root:mailman      2755
  221. /usr/lib/mailman/cgi-bin/admindb                        root:mailman      2755
  222. /usr/lib/mailman/cgi-bin/edithtml                       root:mailman      2755
  223. /usr/lib/mailman/cgi-bin/listinfo                       root:mailman      2755
  224. /usr/lib/mailman/cgi-bin/options                        root:mailman      2755
  225. /usr/lib/mailman/cgi-bin/private                        root:mailman      2755
  226. /usr/lib/mailman/cgi-bin/roster                         root:mailman      2755
  227. /usr/lib/mailman/cgi-bin/subscribe                      root:mailman      2755
  228. /usr/lib/mailman/cgi-bin/confirm                        root:mailman      2755
  229. /usr/lib/mailman/cgi-bin/create                         root:mailman      2755
  230. /usr/lib/mailman/cgi-bin/editarch                       root:mailman      2755
  231. /usr/lib/mailman/cgi-bin/rmlist                         root:mailman      2755
  232. /usr/lib/mailman/mail/mailman                           root:mailman      2755
  233.  
  234. # libgnomesu (#75823)
  235. /opt/gnome/lib/libgnomesu/gnomesu-pam-backend           root:root         0755
  236.  
  237. # control-center2 (#104993)
  238. /opt/gnome/sbin/change-passwd                           root:root         4755
  239.  
  240. #
  241. # cups (#66305)
  242. #
  243. /usr/bin/lppasswd                                       lp:sys            4755
  244.  
  245. #
  246. # networking (need root for the privileged socket)
  247. #
  248. /bin/ping                                               root:root         4755
  249. /bin/ping6                                              root:root         4755
  250. /usr/bin/bing                                           root:trusted      4750
  251. /usr/sbin/traceroute6                                   root:root         4755
  252. # mtr is linked against ncurses. no suid bit, for root only:
  253. /usr/sbin/mtr                                           root:dialout      0755
  254. /usr/bin/rcp                                            root:root         4755
  255. /usr/bin/rlogin                                         root:root         4755
  256. /usr/bin/rsh                                            root:root         4755
  257.  
  258. # OpenPBS #66320
  259. /var/spool/pbs/spool                                    root:root         1777
  260. /var/spool/pbs/undelivered                              root:root         1777
  261. /opt/pbs/sbin/pbs_iff                                   root:root         4755
  262. /opt/pbs/sbin/pbs_rcp                                   root:root         4755
  263.  
  264. # heartbeat #66310
  265. # cl_status needs to be allowed to connect to the heartbeat API. If the setgid
  266. # bit is removed, one can manually add users to the haclient group instead.
  267. /usr/bin/cl_status                                      root:haclient     2555
  268.  
  269. # apache2
  270. /usr/sbin/suexec2                                       root:root         0755
  271.  
  272. # exim
  273. /usr/sbin/exim                                          root:root         4755
  274.  
  275. #
  276. # dialup networking programs
  277. #
  278. /usr/sbin/pppoe-wrapper                                 root:dialout      4750
  279. # i4l package (#100750):
  280. /sbin/isdnctrl                                          root:dialout      4750
  281. # #66111
  282. /usr/bin/vboxbeep                                       root:trusted      0755
  283.  
  284.  
  285. #
  286. # linux text console utilities
  287. # 
  288. # setuid needed on the text console to set the terminal content on ctrl-o
  289. # #66112
  290. /usr/lib/mc/cons.saver                                  root:root         0755
  291.  
  292.  
  293. #
  294. # terminal emulators
  295. # This and future SuSE products have support for the utempter, a small helper
  296. # program that does the utmp/wtmp update work with the necessary rights.
  297. # The use of utempter obsoletes the need for sgid bits on terminal emulator
  298. # binaries. We mention screen here, but all other terminal emulators have
  299. # moved to /etc/permissions, with modes set to 0755.
  300.  
  301. # needs setuid to access /dev/console
  302. # framebuffer terminal emulator (japanese)
  303. /usr/bin/jfbterm                                        root:tty          0755
  304.  
  305. #
  306. # kde
  307. # (all of them are disabled in permissions.secure except for 
  308. # the helper programs)
  309. #
  310. # arts wrapper, normally suid root:
  311. /opt/kde3/bin/artswrapper                               root:root         0755
  312. # needs setuid root when using shadow via NIS:
  313. # #66218
  314. /opt/kde3/bin/kcheckpass                                root:shadow       4755
  315. # do not allow khc_indexbuilder to write into /var/cache/susehelp/
  316. /opt/kde3/bin/khc_indexbuilder                          root:man          0755
  317. # This has a meaning... hmm...
  318. /opt/kde3/bin/kdesud                                    root:nogroup      2755
  319. # used for getting proxy settings from dhcp
  320. /opt/kde3/bin/kpac_dhcp_helper                          root:root         0755
  321. # edits /etc/smb.conf
  322. # #66312
  323. /usr/bin/fileshareset                                   root:root         0755
  324.  
  325. #
  326. # amanda
  327. #
  328. # Well, if you are gid disk already, you don't need these amanda binaries
  329. # to get root.
  330. # Anyway, we don't keep the suid bits.
  331. /usr/sbin/amcheck                                       root:disk         0750
  332. /usr/lib/amanda/calcsize                                root:disk         0750
  333. /usr/lib/amanda/rundump                                 root:disk         0750
  334. /usr/lib/amanda/planner                                 root:disk         0750
  335. /usr/lib/amanda/runtar                                  root:disk         0750
  336. /usr/lib/amanda/dumper                                  root:disk         0750
  337. /usr/lib/amanda/killpgrp                                root:disk         0750
  338.  
  339.  
  340. #
  341. # gnats
  342. #
  343. /usr/lib/gnats/gen-index                                gnats:root        4555
  344. /usr/lib/gnats/pr-edit                                  gnats:root        4555
  345. /usr/lib/gnats/queue-pr                                 gnats:root        4555
  346.  
  347.  
  348. #
  349. # news (inn)
  350. #
  351. # the inn start script changes it's uid to news:news. Later innstart and
  352. # innfeed are called by this user. Those programs do not need to be called by
  353. # anyone else, therefore the strange permissions 4554 are required for
  354. # operation. (#67032)
  355. #
  356. /usr/lib/news/bin/rnews                                 news:uucp         4550
  357. /usr/lib/news/bin/startinnfeed                          root:news         4554
  358. /usr/lib/news/bin/inndstart                             root:news         4554
  359. /usr/lib/news/bin/inews                                 news:news         2555
  360.  
  361.  
  362. #
  363. # fax
  364. #
  365. # restrictive, only for "trusted" group users:
  366. # faxq helper:
  367. /usr/lib/mgetty+sendfax/faxq-helper                     fax:root          4711
  368. /var/spool/fax/outgoing                                 fax:root          0755
  369. /var/spool/fax/outgoing/locks                           fax:root          0755
  370. # TODO: package should set this permissions
  371. /var/spool/fax/archive                                  fax:uucp           700
  372. /var/spool/fax/bin                                      fax:uucp           755
  373. /var/spool/fax/client                                   fax:uucp           755
  374. /var/spool/fax/config                                   fax:uucp           755
  375. /var/spool/fax/dev                                      fax:uucp           755
  376. /var/spool/fax/docq                                     fax:uucp           700
  377. /var/spool/fax/doneq                                    fax:uucp           700
  378. /var/spool/fax/etc                                      fax:uucp           755
  379. /var/spool/fax/info                                     fax:uucp           755
  380. /var/spool/fax/log                                      fax:uucp           755
  381. /var/spool/fax/pollq                                    fax:uucp           700
  382. /var/spool/fax/recvq                                    fax:uucp           755
  383. /var/spool/fax/sendq                                    fax:uucp           700
  384. /var/spool/fax/status                                   fax:uucp           755
  385. /var/spool/fax/tmp                                      fax:uucp           700
  386.  
  387. #
  388. # uucp
  389. #
  390. /var/spool/uucppublic                                   root:uucp         1770
  391. /usr/bin/uucp                                           uucp:uucp         6555
  392. /usr/bin/uuname                                         uucp:uucp         6555
  393. /usr/bin/uustat                                         uucp:uucp         6555
  394. /usr/bin/uux                                            uucp:uucp         6555
  395. /usr/lib/uucp/uucico                                    uucp:uucp         6555
  396. /usr/lib/uucp/uuxqt                                     uucp:uucp         6555
  397.  
  398.  
  399. #
  400. # games of all kinds, toys
  401. # all suid and sgid bits cleared.
  402. #
  403.  
  404. # bsd-games
  405. /usr/games/atc                                          games:games       0755
  406. /usr/games/battlestar                                   games:games       0755
  407. /usr/games/canfield                                     games:games       0755
  408. /usr/games/cribbage                                     games:games       0755
  409. /usr/games/phantasia                                    games:games       0755
  410. /usr/games/robots                                       games:games       0755
  411. /usr/games/sail                                         games:games       0755
  412. /usr/games/snake                                        games:games       0755
  413. /usr/games/tetris-bsd                                   games:games       0755
  414.  
  415. # Maelstrom
  416. /usr/games/Maelstrom                                    games:games       0755
  417.  
  418. # pachi
  419. /usr/games/pachi                                        games:games       0755
  420. /usr/games/martian                                      games:games       0755
  421.  
  422. # nethack
  423. /usr/lib/nethack/nethack.tty                            games:games       0755
  424.  
  425. # chromium,
  426. /usr/games/chromium                                     games:games       0755
  427.  
  428. # geki2
  429. /usr/games/geki2                                        games:games       0755
  430. /usr/games/grande                                       games:games       0755
  431.  
  432. # xscrabble
  433. /usr/games/xscrab                                       games:games       0755
  434.  
  435. # trackballs
  436. /usr/games/trackballs                                   games:games       0755
  437.  
  438. # ltris
  439. /usr/games/ltris                                        games:games       0755
  440.  
  441. # xlogical
  442. /usr/games/xlogical                                     games:games       0755
  443.  
  444. # lbreakout
  445. /usr/games/lbreakout2                                   games:games       0755
  446.  
  447. # xgalaga
  448. /usr/X11R6/bin/xgalaga                                  games:games       0755
  449.  
  450. # xtetris
  451. /usr/X11R6/bin/xtetris                                  games:games       0755
  452.  
  453. # xmris
  454. /usr/X11R6/bin/xmris                                    games:games       0755
  455.  
  456. # rocksndiamonds
  457. /usr/games/rocksndiamonds                               games:games       0755
  458.  
  459. # gnome-games
  460. /opt/gnome/bin/gtali                                    games:games       0755
  461. /opt/gnome/bin/gnotski                                  games:games       0755
  462. /opt/gnome/bin/gnome-stones                             games:games       0755
  463. /opt/gnome/bin/glines                                   games:games       0755
  464. /opt/gnome/bin/gnibbles                                 games:games       0755
  465. /opt/gnome/bin/gnotravex                                games:games       0755
  466. /opt/gnome/bin/mahjongg                                 games:games       0755
  467. /opt/gnome/bin/gnometris                                games:games       0755
  468. /opt/gnome/bin/gnobots2                                 games:games       0755
  469. /opt/gnome/bin/gnomine                                  games:games       0755
  470. /opt/gnome/bin/same-gnome                               games:games       0755
  471.  
  472. # Novell nici. See bug 127545
  473. /var/opt/novell/nici/nicimud                            root:root         4755
  474.