diff --git a/linux_os/guide/system/software/integrity/software-integrity/rpm_verification/rpm_verify_ownership/bash/shared.sh b/linux_os/guide/system/software/integrity/software-integrity/rpm_verification/rpm_verify_ownership/bash/shared.sh index 329a00f56d19..56006d8cebe5 100644 --- a/linux_os/guide/system/software/integrity/software-integrity/rpm_verification/rpm_verify_ownership/bash/shared.sh +++ b/linux_os/guide/system/software/integrity/software-integrity/rpm_verification/rpm_verify_ownership/bash/shared.sh @@ -22,5 +22,9 @@ done # correct values for RPM_PACKAGE in "${!SETPERMS_RPM_DICT[@]}" do + {{% if "rhel" in product %}} + rpm --restore "${RPM_PACKAGE}" + {{% else %}} rpm --setugids "${RPM_PACKAGE}" + {{% endif %}} done diff --git a/linux_os/guide/system/software/integrity/software-integrity/rpm_verification/rpm_verify_ownership/rule.yml b/linux_os/guide/system/software/integrity/software-integrity/rpm_verification/rpm_verify_ownership/rule.yml index 4eaf655d32bd..db0a73262453 100644 --- a/linux_os/guide/system/software/integrity/software-integrity/rpm_verification/rpm_verify_ownership/rule.yml +++ b/linux_os/guide/system/software/integrity/software-integrity/rpm_verification/rpm_verify_ownership/rule.yml @@ -11,7 +11,12 @@ description: |- run the following command to determine which package owns it:
$ rpm -qf FILENAMENext, run the following command to reset its permissions to the correct values: + {{%- if 'rhel' in product %}} +
$ sudo rpm --restore PACKAGENAME+ {{%- else %}}
$ sudo rpm --setugids PACKAGENAME+ {{% endif %}} + rationale: |- Ownership of binaries and configuration files that is incorrect could allow an unauthorized @@ -60,7 +65,11 @@ fixtext: |- Reset the user and group ownership of files within a package with the following command: + {{%- if 'rhel' in product %}} + $ sudo rpm --restore [package] + {{%- else %}} $ sudo rpm --setugids [package] + {{% endif %}} srg_requirement: '{{{ full_name }}} must be configured so that the file ownership and group membership of system files and commands match the vendor values.' diff --git a/linux_os/guide/system/software/integrity/software-integrity/rpm_verification/rpm_verify_permissions/rule.yml b/linux_os/guide/system/software/integrity/software-integrity/rpm_verification/rpm_verify_permissions/rule.yml index 6b237732603a..2ba74afbc68b 100644 --- a/linux_os/guide/system/software/integrity/software-integrity/rpm_verification/rpm_verify_permissions/rule.yml +++ b/linux_os/guide/system/software/integrity/software-integrity/rpm_verification/rpm_verify_permissions/rule.yml @@ -16,7 +16,11 @@ description: |-
$ rpm -qf FILENAME
$ sudo rpm --restore PACKAGENAME+ {{% else %}}
$ sudo rpm --setperms PACKAGENAME+ {{% endif %}} rationale: |- Permissions on system binaries and configuration files that are too generous could allow an @@ -66,7 +70,11 @@ fixtext: |- Reset the permissions of files within a package with the following command: + {{% if 'rhel' in product %}} + $ sudo rpm --restore [package] + {{% else %}} $ sudo rpm --setperms [package] + {{% endif %}} srg_requirement: '{{{ full_name }}} must be configured so that the file permissions of system files and commands match the vendor values.'