Folder permissions on CentOS VPS

CentOSVPS · 12-16-2016, 01:14 AM

Hi guys,

The following directories on my CentOS 6 install are "world writable" (as I understand it).

/dev/shm (1777)
/etc/mime.types (0666)
/tmp (1777)
/tmp/.ICE-unix (1777)
/usr/src/debug/tmp (1777)
/var/log/apache2/modsec_audit (1733)

Can someone tell me:
1. Is this how they're installed?
2. Should I lock them down? (extra big thanks if you explain the risks for each)
3. What perms should they each be changed to?

I'd be extremely grateful if anyone could take a minute to answer. Thanks for reading too!

Jjanel · 12-16-2016, 02:07 AM

sticky+rwx on /tmp & /dev/shm look ok. /usr/src/debug/tmp here (I'm not sure)
This mentions /usr/local/apache/logs/modsec_audit proper permissions of 1733
(web-research: SecAuditLogDirMode 1733 [again, Idk] no-read is tricky!)

Partial answer (I'm just learning this too! Use these as clues to research):

Code:

rpm --qf '%{filemodes:octal}\n' -qf /etc/mime.types
rpm -qlif /etc/mime.types 
rpm -Vf /etc/mime.types

So, 1: one no 2: one yes: see rpm -setperms (web-search each file to get ideas on 'risks')
3: see --qf above (or you can look at a 'live' CentOS7 at linuxzoo.net!)
(ignore the 100 in 100644: see `man 2 stat` about S_IFREG 0100000 regular file)

Any ideas what may have happened to the system you are using (where did it come from)?

Look into this web-search: rpm verify repair file mode

Best wishes... let us know (esp. more specific than like 'risks?')