documentation_complete: true

prodtype: rhel7,fedora,ol7

title: 'Verify and Correct File Permissions with RPM'

description: |-
    The RPM package management system can check file access permissions
    of installed software packages, including many that are important
    to system security.
    Verify that the file permissions of system files
    and commands match vendor values. Check the file permissions
    with the following command:
    <pre>$ sudo rpm -Va | grep '^.M'</pre>
    Output indicates files that do not match vendor defaults.
    After locating a file with incorrect permissions,
    run the following command to determine which package owns it:
    <pre>$ rpm -qf <i>FILENAME</i></pre>
    <br />
    Next, run the following command to reset its permissions to
    the correct values:
    <pre>$ sudo rpm --setperms <i>PACKAGENAME</i></pre>

rationale: |-
    Permissions on system binaries and configuration files that are too generous
    could allow an unauthorized user to gain privileges that they should not have.
    The permissions set by the vendor should be maintained. Any deviations from
    this baseline should be investigated.

severity: high

identifiers:
    cce@rhel7: 27209-6

references:
    cis: 1.2.6,6.1.3,6.1.4,6.1.5,6.1.6,6.1.7,6.1.8,6.1.9,6.2.3
    cjis: 5.10.4.1
    cui: 3.3.8,3.4.1
    disa: 1494,1496
    hipaa: 164.308(a)(1)(ii)(D),164.312(b),164.312(c)(1),164.312(c)(2),164.312(e)(2)(i)
    nist: AC-6,AU-9(1),AU-9(3),CM-6(d),CM-6(3)
    pcidss: Req-11.5
    srg: SRG-OS-000257-GPOS-00098,SRG-OS-000278-GPOS-00108
    stigid@rhel7: "010010"

ocil_clause: 'there is output'

ocil: |-
    The following command will list which files on the system have permissions different from what
    is expected by the RPM database:
    <pre>$ rpm -Va | grep '^.M'</pre>
