Note: This bug is displayed in read-only format because
the product is no longer active in Red Hat Bugzilla.
RHEL Engineering is moving the tracking of its product development work on RHEL 6 through RHEL 9 to Red Hat Jira (issues.redhat.com). If you're a Red Hat customer, please continue to file support cases via the Red Hat customer portal. If you're not, please head to the "RHEL project" in Red Hat Jira and file new tickets here. Individual Bugzilla bugs in the statuses "NEW", "ASSIGNED", and "POST" are being migrated throughout September 2023. Bugs of Red Hat partners with an assigned Engineering Partner Manager (EPM) are migrated in late September as per pre-agreed dates. Bugs against components "kernel", "kernel-rt", and "kpatch" are only migrated if still in "NEW" or "ASSIGNED". If you cannot log in to RH Jira, please consult article #7032570. That failing, please send an e-mail to the RH Jira admins at rh-issues@redhat.com to troubleshoot your issue as a user management inquiry. The email creates a ServiceNow ticket with Red Hat. Individual Bugzilla bugs that are migrated will be moved to status "CLOSED", resolution "MIGRATED", and set with "MigratedToJIRA" in "Keywords". The link to the successor Jira issue will be found under "Links", have a little "two-footprint" icon next to it, and direct you to the "RHEL project" in Red Hat Jira (issue links are of type "https://issues.redhat.com/browse/RHEL-XXXX", where "X" is a digit). This same link will be available in a blue banner at the top of the page informing you that that bug has been migrated.
Description of problem:
[root@localhost ~]# rpm -V postfix
S.5....T. c /etc/postfix/main.cf
.M....G.. /usr/sbin/postdrop
.M....G.. /usr/sbin/postqueue
These files have 'set group ID (2)' set on them by default.
-rwxr-sr-x. 1 root postdrop 20920 Feb 23 09:10 /usr/sbin/postdrop
-rwxr-sr-x. 1 root postdrop 25048 Feb 23 09:10 /usr/sbin/postqueue
Version-Release number of selected component (if applicable):
openscap-1.3.5-6.el8.x86_64
openscap-scanner-1.3.5-6.el8.x86_64
scap-security-guide-0.1.57-5.el8.noarch
How reproducible:
Always
Steps to Reproduce:
1. Scan and remediate system with DISA-STIG profile
2. STIG automatically changes permissions on postdrop and postqueue
Actual results:
The profile remediates the postdrop and postqueue files to be owned by the root user.
Expected results:
-rwxr-sr-x 1 root postdrop 25048 Feb 17 18:06 /usr/sbin/postqueue
-rwxr-sr-x 1 root postdrop 20920 Feb 17 18:06 /usr/sbin/postdrop
Additional info:
This behavior breaks postfix and likely breaks other sgid binaries as well, since it resets everything.
These are the details related to that rule:
------------------------
Verify that system commands files are group owned by root
Rule ID xccdf_org.ssgproject.content_rule_file_groupownership_system_commands_dirs
Result
fixed
Multi-check rule no
OVAL Definition ID oval:ssg-file_groupownership_system_commands_dirs:def:1
Time 2022-05-03T16:48:54-05:00
Severity medium
Identifiers and References
Identifiers: CCE-86519-6
...
Description
System commands files are stored in the following directories by default:
/bin
/sbin
/usr/bin
/usr/sbin
/usr/local/bin
/usr/local/sbin
All files in these directories should be owned by the root group. If the directory, or any file in these directories, is found to be owned by a group other than root correct its ownership with the following command:
$ sudo chgrp root FILE
...
Following items have been found on the system:
Path Type UID GID Size (B) Permissions
/sbin/postqueue regular 0 90 25064 rwxr-sr-x
/usr/sbin/postqueue regular 0 90 25064 rwxr-sr-x
...
/usr/sbin/postdrop regular 0 90 20920 rwxr-sr-x
...
/sbin/postdrop regular 0 90 20920 rwxr-sr-x
------------------------