How to remove group write bit?


 
Thread Tools Search this Thread
Top Forums UNIX for Dummies Questions & Answers How to remove group write bit?
# 1  
Old 10-04-2010
How to remove group write bit?

I know this may sound little incomplete but this is what i read on some linux hardening guide.I dont have any clue on how to remove group's write bit.


I m posting the exact sentence of the hardening guide.
Quote:
The group write bit should removed from all system files that do not explicitly require it to be enabled
What all system files to be taken care of?

---------- Post updated 10-04-10 at 12:39 AM ---------- Previous update was 10-03-10 at 11:40 PM ----------

My distribution details

Quote:
# lsb_release -a
LSB Version: :core-3.1-ia32:core-3.1-noarch:graphics-3.1-ia32:graphics-3.1-noarch
Distributor ID: OracleVMserver
Description: Oracle VM server release 2.2.0
Release: 2.2.0
Codename: n/a

Quote:
# uname -a
Linux OFSMUW-VS-61 2.6.18-128.2.1.4.9.el5xen #1 SMP Fri Oct 9 14:57:31 EDT 2009 i686 i686 i386 GNU/Linux
# 2  
Old 10-04-2010
I'm afraid I really don't know much about your distro, so I'll leave that to people that actually know what they're talking about. Setting (or un-setting) a bit, however, goes like this:

Code:
# chmod (who)(operation)(what) <file>

Here's what that means: To set a bit, first determine who you want to set it for: the (u)ser, the (g)roup or all (o)thers. Then determine the operation, or what you want to do: Do you want to add (+) or remove (-) the bit? Finally, what bit do you want to add or remove? You can do (r)ead, (w)rite or e(x)ecute bits.

You want to remove (-) (w)rite permissions from the (g)roup. That gives you:

Code:
# chmod g-w filename

This User Gave Thanks to treesloth For This Post:
# 3  
Old 10-04-2010
Quote:
Originally Posted by treesloth
I'm afraid I really don't know much about your distro, so I'll leave that to people that actually know what they're talking about. Setting (or un-setting) a bit, however, goes like this:

Code:
# chmod (who)(operation)(what) <file>

Here's what that means: To set a bit, first determine who you want to set it for: the (u)ser, the (g)roup or all (o)thers. Then determine the operation, or what you want to do: Do you want to add (+) or remove (-) the bit? Finally, what bit do you want to add or remove? You can do (r)ead, (w)rite or e(x)ecute bits.

You want to remove (-) (w)rite permissions from the (g)roup. That gives you:

Code:
# chmod g-w filename

What all system files to be taken care of?
# 4  
Old 10-04-2010
Before you start get a complete listing of all files you intend to change, before you change anything. Keep it in a safe place.

This looks like an Oracle distribution of Red Hat -

If that is the case, they mean any executable file under the /usr tree that is owned by root. Not necessarily directories. /usr directories should be owned by 0:1 (root:bin) or root:[some other number under 20] and should already be rwxr-wr-x, except some oddball man pages


Also, the oracle executables in $ORACLE_HOME/bin, as an example:
/oracle/home/product/11.0.2/bin.

If you have weblogic, apache, etc then the same thing for each independent installation - probably the files are in /opt, they may also be in /usr/local/bin.

Be careful. You can break applications pretty easily if the app legitimately needs to write some files. So look at every file permission and be sure they are executables and not links:

Code:
find /usr -perm -021 ! -type l  -ls

 
Login or Register to Ask a Question

Previous Thread | Next Thread

10 More Discussions You Might Find Interesting

1. UNIX for Dummies Questions & Answers

Remove a secondary group from user (Linux)

Oracle Linux 6.6 grid user's secondary groups are asmadmin,asmdba,asmoper and dba # id -a grid uid=638(grid) gid=2000(oinstall) groups=2000(oinstall),2100(asmadmin),2200(dba),2300(asmdba),2301(asmoper) I want to remove dba as the secondary group for grid and keep the remaining ones. ie. I... (5 Replies)
Discussion started by: John K
5 Replies

2. Shell Programming and Scripting

Remove duplicate based on Group

Hi, How can I remove duplicates from a file based on group on other column? for example: Test1|Test2|Test3|Test4|Test5 Test1|Test6|Test7|Test8|Test5 Test1|Test9|Test10|Test11|Test12 Test1|Test13|Test14|Test15|Test16 Test17|Test18|Test19|Test20|Test21 Test17|Test22|Test23|Test24|Test5 ... (2 Replies)
Discussion started by: yale_work
2 Replies

3. Red Hat

How to remove 32/64 bit RPM's from your system

Hi, I have a 64-bit RHEL 5.5. In order to make a particular product work I want to uninstall some rpms which is specific to 64 bit. Wondering if anyone has a way how to remove the 64-bit rpm without disturbing the i386 rpms. What I find when I googled is all are removing forcefully, but... (2 Replies)
Discussion started by: dbashyam
2 Replies

4. Shell Programming and Scripting

search 3 file and write to 4th file (a bit complex)

hi buddies; rollbackip.txt:10.14.3.65 2 10.14.3.65 3 ... lookup.txt: ... 10.14.3.65 2 10.14.5.55 1 55 10.14.6.66 1 66 10.14.3.65 3 10.14.7.77 3 77 10.14.8.88 2 88 10.14.9.99 4 99 ... ip-port.txt ... port111 3 10.14.5.55 57 port111 2 10.14.5.55 51 port111 1 10.14.5.55 59 ->... (7 Replies)
Discussion started by: gc_sw
7 Replies

5. UNIX for Dummies Questions & Answers

Need to remove Group write permission .

How would i write a command that can find all the objects under the etc directory that have group write permission enabled and have not been accessed in the last X days. This is what i got from internet souce but i m not able to modify it according to my distribution. find /etc -perm... (1 Reply)
Discussion started by: pinga123
1 Replies

6. Shell Programming and Scripting

Find all files with group read OR group write OR user write permission

I need to find all the files that have group Read or Write permission or files that have user write permission. This is what I have so far: find . -exec ls -l {} \; | awk '/-...rw..w./ {print $1 " " $3 " " $4 " " $9}' It shows me all files where group read = true, group write = true... (5 Replies)
Discussion started by: shunter63
5 Replies

7. Solaris

How to remove user from a group using command line

Hi, Wanted to remove a user from a group , but no GUI , must use command line (2 Replies)
Discussion started by: civic2005
2 Replies

8. Shell Programming and Scripting

need help in remove group of files

i have some 350 files in a dir: i want to remove them in one shot, ls -ltr | grep 'Sep 15' | head -350 the above command gives me those 350 files i need to remove them,how to implement remove logic here in this command? i can get those 350 files using the above command only and therefore... (6 Replies)
Discussion started by: ali560045
6 Replies

9. UNIX for Dummies Questions & Answers

user & group read/write access question

folks; I created a new users on my SUSE box and i need to give this user/group a read write access to one specific folder. here's the details: - I created new user "funny" under group "users". - I need to give this user "funny" a read/write access to another directory that is owned by "root".... (3 Replies)
Discussion started by: Katkota
3 Replies

10. UNIX for Dummies Questions & Answers

Newly created files default group and write permissions

Whenever I create a new file the group name is "dnn" and the file permissions are "-rw-r--r--". How do I get it so when I create files (with vi or other programs) that the default group is "sss" and the permissions are 770? (I am running HP-UNIX) Thanks, GoldFish (2 Replies)
Discussion started by: goldfish
2 Replies
Login or Register to Ask a Question