diff --git a/linux_os/guide/system/software/integrity/software-integrity/rpm_verification/rpm_verify_ownership/ansible/shared.yml b/linux_os/guide/system/software/integrity/software-integrity/rpm_verification/rpm_verify_ownership/ansible/shared.yml index 5c39628ff4c..f2f7f9b6410 100644 --- a/linux_os/guide/system/software/integrity/software-integrity/rpm_verification/rpm_verify_ownership/ansible/shared.yml +++ b/linux_os/guide/system/software/integrity/software-integrity/rpm_verification/rpm_verify_ownership/ansible/shared.yml @@ -19,6 +19,6 @@ when: (files_with_incorrect_ownership.stdout_lines | length > 0) - name: "Correct file ownership with RPM" - command: "rpm --setugids '{{ item }}'" + command: "rpm --restore '{{ item }}'" with_items: "{{ list_of_packages.results | map(attribute='stdout_lines') | list | unique }}" when: (files_with_incorrect_ownership.stdout_lines | length > 0) diff --git a/linux_os/guide/system/software/integrity/software-integrity/rpm_verification/rpm_verify_ownership/bash/shared.sh b/linux_os/guide/system/software/integrity/software-integrity/rpm_verification/rpm_verify_ownership/bash/shared.sh index 329a00f56d1..815226948ce 100644 --- a/linux_os/guide/system/software/integrity/software-integrity/rpm_verification/rpm_verify_ownership/bash/shared.sh +++ b/linux_os/guide/system/software/integrity/software-integrity/rpm_verification/rpm_verify_ownership/bash/shared.sh @@ -22,5 +22,5 @@ done # correct values for RPM_PACKAGE in "${!SETPERMS_RPM_DICT[@]}" do - rpm --setugids "${RPM_PACKAGE}" + rpm --restore "${RPM_PACKAGE}" done diff --git a/linux_os/guide/system/software/integrity/software-integrity/rpm_verification/rpm_verify_ownership/rule.yml b/linux_os/guide/system/software/integrity/software-integrity/rpm_verification/rpm_verify_ownership/rule.yml index 4eaf655d32b..bad3a3ab1ae 100644 --- a/linux_os/guide/system/software/integrity/software-integrity/rpm_verification/rpm_verify_ownership/rule.yml +++ b/linux_os/guide/system/software/integrity/software-integrity/rpm_verification/rpm_verify_ownership/rule.yml @@ -11,7 +11,7 @@ description: |- run the following command to determine which package owns it:
$ rpm -qf FILENAMENext, run the following command to reset its permissions to the correct values: -
$ sudo rpm --setugids PACKAGENAME+
$ sudo rpm --restore PACKAGENAMErationale: |- Ownership of binaries and configuration files that is incorrect could allow an unauthorized @@ -60,7 +60,8 @@ fixtext: |- Reset the user and group ownership of files within a package with the following command: - $ sudo rpm --setugids [package] + $ sudo rpm --restore [package] + srg_requirement: '{{{ full_name }}} must be configured so that the file ownership and group membership of system files and commands match the vendor values.' diff --git a/linux_os/guide/system/software/integrity/software-integrity/rpm_verification/rpm_verify_permissions/ansible/shared.yml b/linux_os/guide/system/software/integrity/software-integrity/rpm_verification/rpm_verify_permissions/ansible/shared.yml index 0bd8e7e8ad5..7a31fc54f84 100644 --- a/linux_os/guide/system/software/integrity/software-integrity/rpm_verification/rpm_verify_permissions/ansible/shared.yml +++ b/linux_os/guide/system/software/integrity/software-integrity/rpm_verification/rpm_verify_permissions/ansible/shared.yml @@ -19,6 +19,6 @@ when: (files_with_incorrect_permissions.stdout_lines | length > 0) - name: "Correct file permissions with RPM" - command: "rpm --setperms '{{ item }}'" + command: "rpm --restore '{{ item }}'" with_items: "{{ list_of_packages.results | map(attribute='stdout_lines') | list | unique }}" when: (files_with_incorrect_permissions.stdout_lines | length > 0) diff --git a/linux_os/guide/system/software/integrity/software-integrity/rpm_verification/rpm_verify_permissions/rule.yml b/linux_os/guide/system/software/integrity/software-integrity/rpm_verification/rpm_verify_permissions/rule.yml index 6b237732603..db84bcc6441 100644 --- a/linux_os/guide/system/software/integrity/software-integrity/rpm_verification/rpm_verify_permissions/rule.yml +++ b/linux_os/guide/system/software/integrity/software-integrity/rpm_verification/rpm_verify_permissions/rule.yml @@ -16,7 +16,7 @@ description: |-
$ rpm -qf FILENAME
$ sudo rpm --setperms PACKAGENAME+
$ sudo rpm --restore PACKAGENAMErationale: |- Permissions on system binaries and configuration files that are too generous could allow an @@ -66,7 +66,8 @@ fixtext: |- Reset the permissions of files within a package with the following command: - $ sudo rpm --setperms [package] + $ sudo rpm --restore [package] + srg_requirement: '{{{ full_name }}} must be configured so that the file permissions of system files and commands match the vendor values.'