Sample Header Ad - 728x90

Question about home directory permissions script

0 votes
1 answer
62 views
When setting Azure policy on a Linux VM, Microsoft uses the OMS agent to configure everything, in particular, the omsremediate command. Looking through their GitHub site for the OMS agent for Linux, I found their oms_audit.xml file, which lists audit findings and remediations for various policy items (https://github.com/Microsoft/OMS-Agent-for-Linux/blob/master/source/code/plugins/oms_audits.xml ). Audit finding #28 (fix-home-dir-permissions) states that home directory permissions should be set to 750 or more restrictive. Looking at the remediation for this further down in the file, MS provides this script snippet to fix the problem: chmod 750 /home/* if [ -e /var/lib/libuuid ]; then chmod 750 /var/lib/libuuid fi chmod 750 /var/run/dbus chmod 750 /var/run/dbus # /var/run/sshd created by service at bootup if [ -e /etc/init.d/ssh ]; then sed -i 's/\(chmod\s\+\)[0-7]\{4\}/\10750/g' /etc/init.d/ssh fi if [ -e /etc/init.d/sshd ]; then sed -i 's/\(chmod\s\+\)[0-7]\{4\}/\10750/g' /etc/init.d/sshd fi if [ -e /etc/init/ssh.conf ]; then sed -i 's/\(mkdir\s\+-p\s\+-m\)[0-9]\{4\}/\10750/g' /etc/init/ssh.conf fi The first line, I understand. It's setting everything under /home to 750. But what about the next several lines? Is this an error or is there a reason to be changing permissions on /var/lib/libuuid, /var/run/dbus, /etc/init.d/ssh, /etc/init.d/sshd, and /etc/init/ssh.conf? I'm trying to figure out if those lines in the snippet belong under the "fix home dir permissions" section or if they should be somewhere else? I'm trying to translate an existing script that makes extensive use of omsremediate into a script that simply uses native Linux commands, depending on the distro. Anyone have any insight as to why these additional lines would fall under the "fix home dir permissions" section?
Asked by msaacs (1 rep)
May 14, 2024, 06:05 PM
Last activity: May 15, 2024, 02:10 AM