We are upgrading to RHEL 7.6. My Nessus scanner is giving me the following message:
2.2.3.c-d Mandatory Review Required: Find unauthorized SUID/GUID System Executables RHEL7 SSGv0.1 2.2.3 Unauthorized SUID/GUID executables /usr/bin/pkexec /usr/bin/screen /usr/lib/polkit-1/polkit-agent-helper-1 /usr/libexec/dbus-1/dbus-daemon-launch-helper /usr/libexec/sssd/krb5_child /usr/libexec/sssd/ldap_child /usr/libexec/sssd/selinux_child /usr/libexec/sssd/proxy_child
My question is, how do I know if these files should have their sticky-bits set?


Run rpm -V "$(rpm -qf "/usr/bin/pkexec")", for each file to check. If you see an entry like .M....... /usr/bin/pkexec, then the file's mode has been modified. If not, then it's still the same as when it was installed (and for pkexec, it is indeed supposed to have it). Repeat for the rest of them.

Note that this assumes that your package management infrastructure hasn't been compromised, but if it has, then you can't trust anything anyway.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.