documentation_complete: true

title: 'Verify and Correct Ownership with RPM'

description: |-
    The RPM package management system can check file ownership
    permissions of installed software packages, including many that are
    important to system security. After locating a file with incorrect
    permissions, which can be found with
    <pre>rpm -Va | grep "^.....\(U\|.G\)"</pre>
    run the following command to determine which package owns it:
    <pre>$ rpm -qf <i>FILENAME</i></pre>
    Next, run the following command to reset its permissions to
    the correct values:
    <pre>$ sudo rpm --setugids <i>PACKAGENAME</i></pre>

rationale: |-
    Ownership of binaries and configuration files that is incorrect
    could allow an unauthorized user to gain privileges that they should
    not have. The ownership set by the vendor should be maintained. Any
    deviations from this baseline should be investigated.

severity: unknown

identifiers:
    cce: 80499-7

references:
    disa: 1494
    nist: AC-6,CM-6(d),SI-7
    srg: SRG-OS-000257,SRG-OS-000258
    stigid: RHEL-06-000279

ocil_clause: 'there is output'

ocil: |-
    The following command will list which files on the system have ownership different from what
    is expected by the RPM database:
    <pre>$ rpm -Va | grep "^.....\(U\|.G\)"</pre>
