Sign Up
Log In
Log In
or
Sign Up
Places
All Projects
Status Monitor
Collapse sidebar
DISCONTINUED:openSUSE:11.1:Update
permissions
permissions.paranoid
Overview
Repositories
Revisions
Requests
Users
Attributes
Meta
File permissions.paranoid of Package permissions
# /etc/permissions.paranoid # # Copyright (c) 2001 SuSE GmbH Nuernberg, Germany. All rights reserved. # # Author: Roman Drahtmueller <draht@suse.de>, 2001 # # # See /etc/permissions for general hints on how to use this file. # # /etc/permissions.paranoid is NOT designed to be used in a single-user as # well as a multi-user installation, be it networked or not. # Derived from /etc/permissions.secure, it has _all_ sgid and suid bits # cleared - therefore, the system might be useable for non-privileged users # except for simple tasks like changing passwords and such. In addition, # some of the configuration files are not readable for world any more. # # Feel free to use this file as a basis of a system configuration that meets # your understanding of "secure", for the case that you're a bit paranoid. # Since there is no such thing as "it works" with this configuration, please # use these settings with care. Some experience on behalf of the administrator # is needed to have a system running flawlessly when users are present. # In particular, all terminal emulators will not be able to write to utmp # and wtmp any more, which renders who(1) and finger(1) useless. # # Please always keep in mind that your system listens on network sockets # in the default configuration. Change this by disabling the services that # you do not need or by restricting access to them using packet filters # or tcp wrappers (see hosts_access(5)) to gain a higher level of security # in your system. # # Directories # # no lock files for emacs: /var/lib/xemacs/lock root:trusted 1775 # for screen's session sockets: /var/run/uscreens root:trusted 1775 # # /etc # /etc/crontab root:root 600 /etc/exports root:root 600 /etc/fstab root:root 600 /etc/ftpaccess root:root 600 /etc/ftpusers root:root 600 /etc/inetd.conf root:root 600 /etc/inittab root:root 600 /etc/mtab root:root 600 /etc/rmtab root:root 600 /var/lib/nfs/rmtab root:root 600 /etc/syslog.conf root:root 600 # # suid system programs that need the suid bit to work: # /bin/su root:root 0755 # disable at and cron for non-root users /usr/bin/at root:trusted 0755 /usr/bin/crontab root:trusted 0755 /usr/bin/gpasswd root:shadow 0755 /usr/bin/newgrp root:root 0755 /usr/bin/passwd root:shadow 0755 /usr/bin/chfn root:shadow 0755 /usr/bin/chage root:shadow 0755 /usr/bin/chsh root:shadow 0755 /usr/bin/expiry root:shadow 0755 # the default configuration of the sudo package in SuSE distribution is to # intimidate users. /usr/bin/sudo root:root 0755 /usr/sbin/su-wrapper root:root 0755 # opie password system # #66303 /usr/bin/opiepasswd root:root 0755 /usr/bin/opiesu root:root 0755 # "user" entries in /etc/fstab make mount work for non-root users: /usr/bin/ncpmount root:trusted 0755 /usr/bin/ncpumount root:trusted 0755 # #331020 /sbin/mount.nfs root:root 0755 # mount/umount have had their problems already: /bin/mount root:root 0755 /bin/umount root:root 0755 /bin/eject root:audio 0755 # # #133657 /usr/bin/fusermount root:trusted 0755 # #66203 /usr/lib/majordomo/wrapper root:daemon 0755 # glibc backwards compatibility /usr/lib/pt_chown root:root 0755 /usr/lib64/pt_chown root:root 0755 # needs setuid root when using shadow via NIS: # #216816 /sbin/unix_chkpwd root:shadow 0755 /sbin/unix2_chkpwd root:shadow 0755 # qpopper /usr/sbin/popauth pop:trusted 0755 # from the squid package /usr/sbin/pam_auth root:shadow 0755 # still to be converted to utempter /usr/lib/vte/gnome-pty-helper root:tty 0755 # # mixed section: most of it is disabled in this permissions.secure: # ######################################################################### # rpm subsystem: /usr/src/packages/SOURCES/ root:root 700 /usr/src/packages/BUILD/ root:root 700 /usr/src/packages/RPMS/ root:root 700 /usr/src/packages/RPMS/alpha/ root:root 700 /usr/src/packages/RPMS/alphaev56/ root:root 700 /usr/src/packages/RPMS/alphaev67/ root:root 700 /usr/src/packages/RPMS/alphaev6/ root:root 700 /usr/src/packages/RPMS/arm4l/ root:root 700 /usr/src/packages/RPMS/athlon/ root:root 700 /usr/src/packages/RPMS/i386/ root:root 700 /usr/src/packages/RPMS/i486/ root:root 700 /usr/src/packages/RPMS/i586/ root:root 700 /usr/src/packages/RPMS/i686/ root:root 700 /usr/src/packages/RPMS/ia64/ root:root 700 /usr/src/packages/RPMS/mips/ root:root 700 /usr/src/packages/RPMS/ppc/ root:root 700 /usr/src/packages/RPMS/ppc64/ root:root 700 /usr/src/packages/RPMS/powerpc/ root:root 700 /usr/src/packages/RPMS/powerpc64/ root:root 700 /usr/src/packages/RPMS/s390/ root:root 700 /usr/src/packages/RPMS/s390x/ root:root 700 /usr/src/packages/RPMS/sparc/ root:root 700 /usr/src/packages/RPMS/sparcv9/ root:root 700 /usr/src/packages/RPMS/sparc64/ root:root 700 /usr/src/packages/RPMS/x86_64/ root:root 700 /usr/src/packages/RPMS/armv4l/ root:root 700 /usr/src/packages/RPMS/hppa/ root:root 700 /usr/src/packages/RPMS/hppa2.0/ root:root 700 /usr/src/packages/RPMS/noarch/ root:root 700 /usr/src/packages/SPECS/ root:root 700 /usr/src/packages/SRPMS/ root:root 700 ######################################################################### # video /usr/bin/v4l-conf root:video 0755 # Itanium ia32 emulator /usr/lib/ia32el/suid_ia32x_loader root:root 0755 ######################################################################### # scotty: # #66211 /usr/bin/ntping root:trusted 0755 # This is not extensively tested. /usr/bin/vlock root:shadow 0755 /usr/bin/Xorg root:root 0711 # turned off write and wall by disabling sgid tty: /usr/bin/wall root:tty 0755 /usr/bin/write root:tty 0755 # thttpd /usr/bin/makeweb root:www 0750 # yaps, pager software, accesses /dev/ttyS? . Disabled sgid uucp. /usr/bin/yaps root:uucp 0755 # ncpfs tool: trusted only /usr/bin/nwsfind root:trusted 0750 /usr/bin/ncplogin root:trusted 0750 /usr/bin/ncpmap root:trusted 0750 # lpdfilter: # checks itself that only lp and root can call it /usr/lib/lpdfilter/bin/runlpr root:root 0755 # pcmcia: # Needs setuid to eject cards (#100120) /sbin/pccardctl root:trusted 0755 # gnokii nokia cellphone software # #66209 /usr/sbin/mgnokiidev root:uucp 755 # pcp, performance co-pilot # setuid root is used to write /var/log/pcp/NOTICES # #66205 /usr/lib/pcp/pmpost root:trusted 0755 # mailman mailing list software # #66315 /usr/lib/mailman/cgi-bin/admin root:mailman 0755 /usr/lib/mailman/cgi-bin/admindb root:mailman 0755 /usr/lib/mailman/cgi-bin/edithtml root:mailman 0755 /usr/lib/mailman/cgi-bin/listinfo root:mailman 0755 /usr/lib/mailman/cgi-bin/options root:mailman 0755 /usr/lib/mailman/cgi-bin/private root:mailman 0755 /usr/lib/mailman/cgi-bin/roster root:mailman 0755 /usr/lib/mailman/cgi-bin/subscribe root:mailman 0755 /usr/lib/mailman/cgi-bin/confirm root:mailman 0755 /usr/lib/mailman/cgi-bin/create root:mailman 0755 /usr/lib/mailman/cgi-bin/editarch root:mailman 0755 /usr/lib/mailman/cgi-bin/rmlist root:mailman 0755 /usr/lib/mailman/mail/mailman root:mailman 0755 # libgnomesu (#75823, #175616) /usr/lib/libgnomesu/gnomesu-pam-backend root:root 0755 # control-center2 (#104993) /usr/sbin/change-passwd root:root 0755 # # cups (#66305,#406058) # /usr/bin/lppasswd lp:lp 0755 # # smb printing with kerberos authentication (#177114) # /usr/bin/get_printing_ticket root:lp 0755 # # networking (need root for the privileged socket) # /bin/ping root:root 0755 /bin/ping6 root:root 0755 /usr/sbin/traceroute6 root:root 0755 # mtr is linked against ncurses. /usr/sbin/mtr root:dialout 0755 /usr/bin/rcp root:root 0755 /usr/bin/rlogin root:root 0755 /usr/bin/rsh root:root 0755 # heartbeat #66310 # cl_status needs to be allowed to connect to the heartbeat API. If the setgid # bit is removed, one can manually add users to the haclient group instead. /usr/bin/cl_status root:haclient 0555 # exim /usr/sbin/exim root:root 0755 # # dialup networking programs # /usr/sbin/pppoe-wrapper root:dialout 0750 # i4l package (#100750): /sbin/isdnctrl root:dialout 0750 # #66111 /usr/bin/vboxbeep root:trusted 0755 # # linux text console utilities # # setuid needed on the text console to set the terminal content on ctrl-o # #66112 /usr/lib/mc/cons.saver root:root 0755 # # terminal emulators # This and future SuSE products have support for the utempter, a small helper # program that does the utmp/wtmp update work with the necessary rights. # The use of utempter obsoletes the need for sgid bits on terminal emulator # binaries. We mention screen here, but all other terminal emulators have # moved to /etc/permissions, with modes set to 0755. # framebuffer terminal emulator (japanese). /usr/bin/jfbterm root:tty 0755 # # kde # # arts wrapper, normally suid root: /opt/kde3/bin/artswrapper root:root 0755 # needs setuid root when using shadow via NIS: # #66218 /opt/kde3/bin/kcheckpass root:shadow 0755 /usr/lib/kde4/libexec/kcheckpass root:shadow 0755 /usr/lib64/kde4/libexec/kcheckpass root:shadow 0755 # This has a meaning... hmm... /opt/kde3/bin/kdesud root:nogroup 0755 /usr/lib/kde4/libexec/kdesud root:nogroup 0755 /usr/lib64/kde4/libexec/kdesud root:nogroup 0755 # used for getting proxy settings from dhcp /opt/kde3/bin/kpac_dhcp_helper root:root 0755 # used to distract the oom killer # #203535 /opt/kde3/bin/start_kdeinit root:root 0755 # edits /etc/smb.conf # #66312 /usr/bin/fileshareset root:root 0755 # # amanda # # Well, if you are gid disk already, you don't need these amanda binaries # to get root. # Anyway, we don't keep the suid bits. /usr/sbin/amcheck root:disk 0750 /usr/lib/amanda/calcsize root:disk 0750 /usr/lib/amanda/rundump root:disk 0750 /usr/lib/amanda/planner root:disk 0750 /usr/lib/amanda/runtar root:disk 0750 /usr/lib/amanda/dumper root:disk 0750 /usr/lib/amanda/killpgrp root:disk 0750 # # gnats # /usr/lib/gnats/gen-index gnats:root 0555 /usr/lib/gnats/pr-edit gnats:root 0555 /usr/lib/gnats/queue-pr gnats:root 0555 # # news (inn) # # the inn start script changes it's uid to news:news. Later innstart and # innfeed are called by this user. Those programs do not need to be called by # anyone else, therefore the strange permissions 4554 are required for # operation. (#67032) # /usr/lib/news/bin/rnews news:uucp 0555 /usr/lib/news/bin/startinnfeed root:news 0555 /usr/lib/news/bin/inndstart root:news 0555 /usr/lib/news/bin/inews news:news 0555 # # fax # # restrictive, only for "trusted" group users: # faxq helper: /usr/lib/mgetty+sendfax/faxq-helper fax:root 0711 /var/spool/fax/outgoing fax:trusted 1770 /var/spool/fax/outgoing/locks fax:trusted 1770 # TODO: package should set this permissions /var/spool/fax/archive fax:uucp 700 /var/spool/fax/bin fax:uucp 755 /var/spool/fax/client fax:uucp 755 /var/spool/fax/config fax:uucp 755 /var/spool/fax/dev fax:uucp 755 /var/spool/fax/docq fax:uucp 700 /var/spool/fax/doneq fax:uucp 700 /var/spool/fax/etc fax:uucp 755 /var/spool/fax/info fax:uucp 755 /var/spool/fax/log fax:uucp 755 /var/spool/fax/pollq fax:uucp 700 /var/spool/fax/recvq fax:uucp 755 /var/spool/fax/sendq fax:uucp 700 /var/spool/fax/status fax:uucp 755 /var/spool/fax/tmp fax:uucp 700 # # uucp # /var/spool/uucppublic root:uucp 1770 /usr/bin/uucp uucp:uucp 0555 /usr/bin/uuname uucp:uucp 0555 /usr/bin/uustat uucp:uucp 0555 /usr/bin/uux uucp:uucp 0555 /usr/lib/uucp/uucico uucp:uucp 0555 /usr/lib/uucp/uuxqt uucp:uucp 0555 # # games of all kinds, toys # # bsd-games /usr/games/atc games:games 0755 /usr/games/battlestar games:games 0755 /usr/games/canfield games:games 0755 /usr/games/cribbage games:games 0755 /usr/games/phantasia games:games 0755 /usr/games/robots games:games 0755 /usr/games/sail games:games 0755 /usr/games/snake games:games 0755 /usr/games/tetris-bsd games:games 0755 # Maelstrom /usr/games/Maelstrom games:games 0755 # pachi /usr/games/pachi games:games 0755 /usr/games/martian games:games 0755 # nethack /usr/lib/nethack/nethack.tty games:games 0755 # chromium, /usr/games/chromium games:games 0755 # xscrabble /usr/games/xscrab games:games 0755 # trackballs /usr/games/trackballs games:games 0755 # ltris /usr/games/ltris games:games 0755 # xlogical /usr/games/xlogical games:games 0755 # lbreakout /usr/games/lbreakout2 games:games 0755 # xgalaga /usr/bin/xgalaga games:games 0755 # rocksndiamonds /usr/games/rocksndiamonds games:games 0755 # gnome-games /usr/bin/glines games:games 0755 /usr/bin/gnibbles games:games 0755 /usr/bin/gnobots2 games:games 0755 /usr/bin/gnometris games:games 0755 /usr/bin/gnomine games:games 0755 /usr/bin/gnotravex games:games 0755 /usr/bin/gnotski games:games 0755 /usr/bin/gtali games:games 0755 /usr/bin/mahjongg games:games 0755 /usr/bin/same-gnome games:games 0755 # zypp (#385207) /usr/sbin/zypp-refresh-wrapper root:root 0755 # PolicyKit (#295341) /usr/lib/PolicyKit/polkit-set-default-helper root:polkituser 0755 /usr/lib/PolicyKit/polkit-read-auth-helper root:polkituser 0755 /usr/lib/PolicyKit/polkit-revoke-helper root:polkituser 0755 /usr/lib/PolicyKit/polkit-explicit-grant-helper root:polkituser 0755 /usr/lib/PolicyKit/polkit-grant-helper root:polkituser 0755 /usr/lib/PolicyKit/polkit-grant-helper-pam root:polkituser 0755 # dbus-1 (#333361) /lib/dbus-1/dbus-daemon-launch-helper root:messagebus 0750 /lib64/dbus-1/dbus-daemon-launch-helper root:messagebus 0750 # policycoreutils (#440596) /usr/bin/newrole root:root 0755 # VirtualBox (#429725) /usr/lib/virtualbox/VirtualBox root:vboxusers 0755 /usr/lib/virtualbox/VirtualBox3 root:vboxusers 0755 /usr/lib/virtualbox/VBoxBFE root:vboxusers 0755 /usr/lib/virtualbox/VBoxHeadless root:vboxusers 0755 /usr/lib/virtualbox/VBoxSDL root:vboxusers 0755
Locations
Projects
Search
Status Monitor
Help
OpenBuildService.org
Documentation
API Documentation
Code of Conduct
Contact
Support
@OBShq
Terms
openSUSE Build Service is sponsored by
The Open Build Service is an
openSUSE project
.
Sign Up
Log In
Places
Places
All Projects
Status Monitor
