We are upgrading to RHEL 7.6. My Nessus scanner is giving me the following message:
2.2.3.c-d Mandatory Review Required: Find unauthorized SUID/GUID System Executables RHEL7 SSGv0.1 2.2.3 Unauthorized SUID/GUID executables /usr/bin/pkexec /usr/bin/screen /usr/lib/polkit-1/polkit-agent-helper-1 /usr/libexec/dbus-1/dbus-daemon-launch-helper /usr/libexec/sssd/krb5_child /usr/libexec/sssd/ldap_child /usr/libexec/sssd/selinux_child /usr/libexec/sssd/proxy_child
My question is, how do I know if these files should have their sticky-bits set?

1 Answer 1


Run rpm -V "$(rpm -qf "/usr/bin/pkexec")", for each file to check. If you see an entry like .M....... /usr/bin/pkexec, then the file's mode has been modified. If not, then it's still the same as when it was installed (and for pkexec, it is indeed supposed to have it). Repeat for the rest of them.

Note that this assumes that your package management infrastructure hasn't been compromised, but if it has, then you can't trust anything anyway.


You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .