Paranoid security, bypass resetting permissions

[Raynald Boucher]

Good Day all,

We have installed Linux (mandrake 9) with a security level of "paranoid". While this is good, it can get quite annoying. for example:
there is a cron job that appears to reset ownership of all subdirectories and files under /var to root with permisions 700 and 600 respectively.
A real pain because no other user can read anything from /var/log.

Is there a way to disable this functionality for /var/log or a subdirectory?

I suspect I could store my reports somewhere else under some /home/ to avoid this problem, but I'd rather know how to configure security properly.

Thanks &
Take care.

[Kodjo Agbenu]

I don't know how Mandrake implement this functionality, but I remember in an old SuSE version I used few years ago, there were a file in /etc for configuring that (something like /etc/perms).

Check in Mandrake documentation or simply grep in /etc to find the right config file.

Good luck.

Kodjo

[Steven E. Protter]

crontab -e

Most likely there will be comments and you can find and modify the offending cron job.

SEP

[Jean-Pierre Denis]

Hi,

msec by default is making this happen...

Go look in :
/usr/share/msec

and take a look at the perm.5 file. (this is if you are running msec at level 5. I think "paranoid" which is the highest level is level5.)

you will see this for /var/log:
/var/log/ root.root 711
/var/log/* root.root 600
/var/log/*/* current 600
/var/log/*/*/* current 600
/var/log/*/. current 700

Simply replace the 600 or 700 with the permission you want to set.

Them run msec 5 again and all the permission will be applied to your system.

Thanks,
JP

[Jean-Pierre Denis · Accepted solution]

Hi again,

instead of changing the file in /usr/share/msec you can create the file /etc/security/msec/perm.local and set your local permission in there.

This will overwrite the change made by perm.5 and if you upgrade msec one of there days your "local" config will be kept.

Thank,
JP

[Raynald Boucher]

Merci Jean-Pierre.

I was getting close but got sidetracked by that Python code.

Thanks all.