A Security Readiness Review (SRR) script was run against our servers operating system and several STIG violations related to Oracle directories were found.
These files are listed below:
-rwsr-s--- 1 oracle dba 2986436 Mar 31 14:12 dbsnmp
-r-sr-s--- 1 oracle dba 11784 Oct 14 2004 oradism
-rwsr-s--x 1 oracle dba 65422428 Mar 31 16:53 oracle
-rwsr-s--x 1 oracle dba 65357392 Mar 31 14:13 oracleO
-rwSr----- 1 oracle dba 1536 Apr 12 01:06 orapwriacurw
-rwSr----- 1 oracle dba 1536 Apr 12 01:20 orapwriacutm
I am not familiar with how SUID and SGID works. Do these files have a sticky
bit set on them? The security team says that the permissions are a sticky bit violation and that they need to be changed (i.e. remove the s). My concern is whether or not changing these permission to satisfy them will cause certain processes not to run or break anything in Oracle. If these permission settings must remain this way then I have to supply a written justification. Can someone provide and explanation, guidance, and/or recommendation for this issue?
This Question has been solved and asker verified All Experts Exchange premium technology solutions are available to subscription members.
Experts Exchange has been collecting answers to technology questions since 1996…3 million and counting! If you have a question, chances are we already have your answer.
If you can't find the exact answer you're looking for, ask our exclusive community of 50,000 experts. You’ll get a personalized answer from a trusted professional.
Thousands of free tech tips, tricks, how-to’s and tutorials are available in our peer reviewed articles section. See for yourself how smart our experts are, no login required.
Save solutions to your questions, answers you’ve discovered through searching plus helpful articles in your personal knowledgebase for easy future access.
Access the answers to your technology questions today.
30-day free trial. Register in 60 seconds.
Members of the expert community talk about why the experience at Experts Exchange is different than what you will find anywhere else.
Try it out and discover for yourself.
30-day free trial. Register in 60 seconds.
Join the community of experts here and help other tech pros by answering question in your area of expertise. You can earn FREE access to all Experts Exchange's premium features and resources.
-rwsr-s--x 1 oracle dba 65422428 Mar 31 16:53 oracle
it is the correct permission.
to make sure when oracle is running as user pracle and group dba.
To learn more details about "SUID, SGID, and Sticky Bits", please read
http://www.unix.org.ua/ore
http://www.zzee.com/soluti
If a script or program has permssions like:
-rwsr-s--x 1 root root 65422428 Mar 31 16:53 someapp
then you need to pay attention on what's someapp for.
Business Accounts
Answer for Membership
by: TintinPosted on 2006-04-20 at 16:02:22ID: 16503280
None of the files have a sticky bit set.
If they had a sticky bit, it would look like:
-rwsr-s--t 1 oracle dba 2986436 Mar 31 14:12 dbsnmp
Sticky bits are most commonly used on directories. /tmp is a prime example where its permissions are 1777 (drwxrwxrwt). The sticky bit prevents users deleting files in /tmp that aren't owned by them even though there is group write permission.
I really hope your security team knows the difference between sticky and suid and guid bits.
Essentially the permissions allow any user who is in the 'dba' group to be able to access and run most (not all) things that the 'oracle' user can. If you don't have any users in the dba group, then you could possibilly change permissions