`rpm_verify_permission` and `file_permissions_library_dirs` conflict - `/usr/lib/polkit-1/polkit-agent-helper-1` permissions

[mildas]

Description of problem:

/usr/lib/polkit-1/polkit-agent-helper-1 permissions according to rpm database:

# rpm -q --queryformat="[%{FILEMODES:perms} %{FILENAMES}\n]" polkit | grep polkit-agent-helper-1
-rwsr-xr-x /usr/lib/polkit-1/polkit-agent-helper-1

It conflicts with file_permissions_library_dirs rule that expects all files in /lib, /lib64, /usr/lib, and /usr/lib64 directories to have 0755 or stricter permissions.

When both rules, file_permissions_library_dirs and rpm_verify_permission, are included in a profile (E8 profile), one of them will fail after remediations:

1. -rwxr-xr-x /usr/lib/polkit-1/polkit-agent-helper-1
   • file_permissions_library_dirs pass, rpm_verify_permission fail because permissions are incorrect according to rpm database
2. -rwsr-xr-x /usr/lib/polkit-1/polkit-agent-helper-1
   • rpm_verify_permission pass, file_permissions_library_dirs fail because permissions have setuid bit

SCAP Security Guide Version:

abcfadc

[yuumasato]

The rule file_permissions_library_dirs is stripping the suid bit from /usr/lib/polkit-1/polkit-agent-helper-1`, but the binary needs it to work properly.

The binary is in /usr/lib because it is not meant to be directly called by users.
According to https://refspecs.linuxfoundation.org/FHS_3.0/fhs/ch04s06.html this is fine. But it could also be placed in /usr/libexec.

For now we need to add an exclude filter for this binary in the rule (template) and probably suggst update to STIG with this exception.

[ggbecker]

We have talked with DISA regarding this, and probably a different approach will be taken, for example instead of using

chmod 755 file,

it will use something like chmod g-w,o-w file instead so it ensures that write permissions are not available for group and others. This imply that any other bit set in the permissions vector will remain intact.