We are upgrading to RHEL 7.6. My Nessus scanner is giving me the following message:
2.2.3.c-d Mandatory Review Required: Find unauthorized SUID/GUID System Executables
RHEL7 SSGv0.1 2.2.3 Unauthorized SUID/GUID executables
/usr/bin/pkexec
/usr/bin/screen
/usr/lib/polkit-1/polkit-agent-helper-1
/usr/libexec/dbus-1/dbus-daemon-launch-helper
/usr/libexec/sssd/krb5_child
/usr/libexec/sssd/ldap_child
/usr/libexec/sssd/selinux_child
/usr/libexec/sssd/proxy_child
My question is, how do I know if these files should have their sticky-bits set?
Add a comment
|
1 Answer
Run rpm -V "$(rpm -qf "/usr/bin/pkexec")", for each file to check. If you see an entry like .M....... /usr/bin/pkexec, then the file's mode has been modified. If not, then it's still the same as when it was installed (and for pkexec, it is indeed supposed to have it). Repeat for the rest of them.
Note that this assumes that your package management infrastructure hasn't been compromised, but if it has, then you can't trust anything anyway.
answered Jun 25, 2019 at 1:25
Joseph Sible-Reinstate MonicaJoseph Sible-Reinstate Monica
7,2783 gold badges22 silver badges35 bronze badges