Re: sudoers is mode 0440, should bo 0640

In article <slrndvcb5q.es0.ibuprofin@xxxxxxxxxxxxxxxxx>,
Moe Trin <ibuprofin@xxxxxxxxxxxxxxxxxxxxxx> wrote:
:On 16 Feb 2006, in the Usenet newsgroup linux.redhat, in article
:<1140122669.320900.263470@xxxxxxxxxxxxxxxxxxxxxxxxxxxx>, kona_iron@xxxxxxxx
:wrote:
:>We distribute the same sudoers file on both our Solaris and Linux
:>machines.
:>All /etc/sudoers file are set to 0440
:>It works well on Solaris machines.
:>But on Linux RedHat I got the following error using sudo :
:>sudo : /etc/sudoers is mode 0440, should be 0640
:>
:>Any idea where is the problem ?
:
:That's an internal security check that the file has the "original"
:(meaning "safe") permissions. If you don't like that, you should
:have the source, so you can reach in and change it, then recompile.
:
:>Because I do not like to set 0640 my /etc/sudoers file
:
:Why not? The file should be owned by root:root and unless you have
:removed the execute bits on /bin/chmod any security gained by
:removing write access by the file owner is totally illusionary.

Doubly so if the owner is root, since root can write to a mode 0400
file without doing anything special.

# echo hello >junk
# chmod 400 junk
# echo there >>junk
# cat junk
hello
there
# ls -l junk
-r-------- 1 root root 12 Feb 18 08:11 junk

--
Bob Nichols AT comcast.net I am "RNichols42"
.

Relevant Pages

  • File Permissions are incorrect. Security flaw in Linux
    ... A low level user can delete a file owned by root and belonging to group ... Permissions on a file basis take precedence over directory ... # chmod 777 junk ... # cp rootfile rootfile2 ...
    (Linux-Kernel)
  • Re: z/OS 1.13 - Can the root file system be shared as read/write?
    ... NOT a good idea, as others have said, you will find "junk" collecting in it. ... The root here was made read/write when the previous person did 1.10, but under 1.12, I made it read-only. ...
    (bit.listserv.ibm-main)
  • Re: strange apache/mysql problem
    ... >> We got hit by a spammer a few days ago that managed to fill our root ... >> partition up completely with junk ... the spammer sent so many emails so fast that our ... mail queue got big enough to fill the root partition (where it's ...
    (alt.os.linux)
  • Re: Paging the springisti
    ... this kind of junk somewhere which you could root through until you found ... Melvyn Clark in Carshalton. ...
    (uk.rec.motorcycles)
  • Passing command-line arguments
    ... script and pass them to another script. ... echo 'This is from quote.sh' ... quote.sh junk 'test parameter' ...
    (comp.unix.shell)