topic Re: /etc/useracct/utmpd_read, why world writable? in Operating System - HP-UX

/etc/useracct/utmpd_read, why world writable?

Carl Cloutier — Wed, 06 Aug 2008 15:48:08 GMT

Hello,

I am getting a security audit violation for having world writable permissions on the /etc/useracct/utmpd_read file. Does this file have to be world writable and if so why?

Thank you,
Carl

Re: /etc/useracct/utmpd_read, why world writable?

Steven E. Protter — Wed, 06 Aug 2008 16:33:53 GMT

Shalom Carl,

Strange day for me. Lots of stuff I never saw before.

I'm not familiar with this file. I'm not even sure its a part of HP-UX.

Can you do a uname -a and let us know what version of the OS this is and what security enhancements you have installed?

SEP

Re: /etc/useracct/utmpd_read, why world writable?

James R. Ferguson — Wed, 06 Aug 2008 16:39:45 GMT

Hi Carl:

Since this file and its companions are part of the accounting for currently logged-in users, I think that the audit isn't context-sensitive". Stated differently, the audit may be overly paranoid.

http://docs.hp.com/en/B3921-60631/utmpd.1M.html

I would suspect that the 'umask' setting at the time accounting is enabled may be too lax.

Regards!

...JRF...

Re: /etc/useracct/utmpd_read, why world writable?

TTr — Wed, 06 Aug 2008 16:56:49 GMT

That file is not a regular file, it is a socket. Typically sockets are world writable and if you search in the system for more sockets (find / -type s -exec ll {} \;) you will find that most sockets are world writable. I can't tell what will happen if you change the permissions.
Every socket file is used by two or more processes. If these processes are owned by the socket owner/group they should be able to use the socket if you take away the world write access.

Re: /etc/useracct/utmpd_read, why world writable?

Carl Cloutier — Thu, 07 Aug 2008 18:06:23 GMT

Thank you everyone for your replies. TTr, thank you for pointing out that the file is a socket. I overlooked that fact. I will likely push for an exception for this file from the security violation.