# /etc/permissions.paranoid
#
# Copyright (c) 2001 SuSE GmbH Nuernberg, Germany.  All rights reserved.
#
# Author: Roman Drahtmueller <draht@suse.de>, 2001
#
# 
# See /etc/permissions for general hints on how to use this file.
#
# /etc/permissions.paranoid is NOT designed to be used in a single-user as
# well as a multi-user installation, be it networked or not.
# Derived from /etc/permissions.secure, it has _all_ sgid and suid bits
# cleared - therefore, the system might be useable for non-privileged users
# except for simple tasks like changing passwords and such. In addition, 
# some of the configuration files are not readable for world any more.
#
# Feel free to use this file as a basis of a system configuration that meets
# your understanding of "secure", for the case that you're a bit paranoid.
# Since there is no such thing as "it works" with this configuration, please
# use these settings with care. Some experience on behalf of the administrator
# is needed to have a system running flawlessly when users are present.
# In particular, all terminal emulators will not be able to write to utmp
# and wtmp any more, which renders who(1) and finger(1) useless.
#
# Please always keep in mind that your system listens on network sockets
# in the default configuration. Change this by disabling the services that 
# you do not need or by restricting access to them using packet filters
# or tcp wrappers (see hosts_access(5)) to gain a higher level of security
# in your system.

#
# Directories
#
# for screen's session sockets:
/var/run/uscreens/                                      root:trusted      1775
/run/uscreens/                                      	root:trusted      1775


#
# /etc
#
/etc/crontab                                            root:root          600
/etc/exports                                            root:root          600
/etc/fstab                                              root:root          600
/etc/ftpaccess                                          root:root          600
/etc/ftpusers                                           root:root          600
/var/lib/nfs/rmtab                                      root:root          600
/etc/syslog.conf                                        root:root          600
/etc/ssh/sshd_config                                    root:root          600
/etc/cron.d                                             root:root          700
/etc/cron.daily                                         root:root          700
/etc/cron.hourly                                        root:root          700
/etc/cron.monthly                                       root:root          700
/etc/cron.weekly                                        root:root          700

#
# suid system programs that need the suid bit to work:
#
/bin/su                                                 root:root         0755
# disable at and cron for non-root users
/usr/bin/at                                             root:trusted      0755
/usr/bin/crontab                                        root:trusted      0755
/usr/bin/gpasswd                                        root:shadow       0755
/usr/bin/newgrp                                         root:root         0755
/usr/bin/passwd                                         root:shadow       0755
/usr/bin/chfn                                           root:shadow       0755
/usr/bin/chage                                          root:shadow       0755
/usr/bin/chsh                                           root:shadow       0755
/usr/bin/expiry                                         root:shadow       0755
/usr/bin/sudo                                           root:root         0755
/usr/sbin/su-wrapper                                    root:root         0755
# opie password system
# #66303
/usr/bin/opiepasswd                                     root:root         0755
# "user" entries in /etc/fstab make mount work for non-root users:
/usr/bin/ncpmount                                       root:trusted      0755
/usr/bin/ncpumount                                      root:trusted      0755
# #331020
/sbin/mount.nfs                                         root:root         0755
/bin/mount                                              root:root         0755
/bin/umount                                             root:root         0755
#
# #133657
/usr/bin/fusermount                                     root:trusted      0755
# #66203
/usr/lib/majordomo/wrapper                              root:daemon       0755
# glibc backwards compatibility
/usr/lib/pt_chown                                       root:root         0755
/usr/lib64/pt_chown                                     root:root         0755
# needs setuid root when using shadow via NIS:
# #216816
/sbin/unix_chkpwd                                       root:shadow       0755
/sbin/unix2_chkpwd                                      root:shadow       0755
# qpopper
/usr/sbin/popauth                                       pop:trusted       0755
# from the squid package
/usr/sbin/pam_auth                                      root:shadow       0755

# /quid changes from bnc#891268
/var/cache/squid/                                       squid:root        0750
/var/log/squid/                                         squid:root        0750
/usr/lib/squid/pinger                                   root:squid        0750


# still to be converted to utempter
/usr/lib/gnome-pty-helper                               root:utmp         0755

#
# mixed section: most of it is disabled in this permissions.secure:
#
# video
/usr/bin/v4l-conf                                       root:video        0755
# Itanium ia32 emulator
/usr/lib/ia32el/suid_ia32x_loader                       root:root         0755
#########################################################################
# scotty:
# #66211
/usr/bin/ntping                                         root:trusted      0755

# turned off write and wall by disabling sgid tty:
/usr/bin/wall                                           root:tty          0755
/usr/bin/write                                          root:tty          0755
# thttpd
/usr/bin/makeweb                                        root:www          0750
# yaps, pager software, accesses /dev/ttyS? . Disabled sgid uucp.
/usr/bin/yaps                                           root:uucp         0755
# ncpfs tool: trusted only
/usr/bin/nwsfind                                        root:trusted      0750
/usr/bin/ncplogin                                       root:trusted      0750
/usr/bin/ncpmap                                         root:trusted      0750
# lpdfilter:
# checks itself that only lp and root can call it
/usr/lib/lpdfilter/bin/runlpr                           root:root         0755
# pcmcia:
# Needs setuid to eject cards (#100120)
/sbin/pccardctl                                         root:trusted      0755
# gnokii nokia cellphone software
# #66209
/usr/sbin/mgnokiidev                                    root:uucp          755
# pcp, performance co-pilot
# setuid root is used to write /var/log/pcp/NOTICES
# #66205
/usr/lib/pcp/pmpost                                     root:trusted      0755
# mailman mailing list software
# #66315
/usr/lib/mailman/cgi-bin/admin                          root:mailman      0755
/usr/lib/mailman/cgi-bin/admindb                        root:mailman      0755
/usr/lib/mailman/cgi-bin/edithtml                       root:mailman      0755
/usr/lib/mailman/cgi-bin/listinfo                       root:mailman      0755
/usr/lib/mailman/cgi-bin/options                        root:mailman      0755
/usr/lib/mailman/cgi-bin/private                        root:mailman      0755
/usr/lib/mailman/cgi-bin/roster                         root:mailman      0755
/usr/lib/mailman/cgi-bin/subscribe                      root:mailman      0755
/usr/lib/mailman/cgi-bin/confirm                        root:mailman      0755
/usr/lib/mailman/cgi-bin/create                         root:mailman      0755
/usr/lib/mailman/cgi-bin/editarch                       root:mailman      0755
/usr/lib/mailman/cgi-bin/rmlist                         root:mailman      0755
/usr/lib/mailman/mail/mailman                           root:mailman      0755

# libgnomesu (#75823, #175616)
/usr/lib/libgnomesu/gnomesu-pam-backend                 root:root         0755

# control-center2 (#104993)
/usr/sbin/change-passwd                                 root:root         0755

#
# networking (need root for the privileged socket)
#
/usr/bin/ping                                           root:root         0755
/usr/bin/ping6                                          root:root         0755
# mtr is linked against ncurses.
/usr/sbin/mtr                                           root:dialout      0750
/usr/bin/rcp                                            root:root         0755
/usr/bin/rlogin                                         root:root         0755
/usr/bin/rsh                                            root:root         0755

# heartbeat #66310
# cl_status needs to be allowed to connect to the heartbeat API. If the setgid
# bit is removed, one can manually add users to the haclient group instead.
/usr/bin/cl_status                                      root:haclient     0555

# exim
/usr/sbin/exim                                          root:root         0755

#
# dialup networking programs
#
/usr/sbin/pppoe-wrapper                                 root:dialout      0750
# i4l package (#100750):
/sbin/isdnctrl                                          root:dialout      0750
# #66111
/usr/bin/vboxbeep                                       root:trusted      0755


#
# linux text console utilities
#
# setuid needed on the text console to set the terminal content on ctrl-o
# #66112
/usr/lib/mc/cons.saver                                  root:root         0755


#
# terminal emulators
# This and future SuSE products have support for the utempter, a small helper
# program that does the utmp/wtmp update work with the necessary rights.
# The use of utempter obsoletes the need for sgid bits on terminal emulator
# binaries. We mention screen here, but all other terminal emulators have
# moved to /etc/permissions, with modes set to 0755.

# framebuffer terminal emulator (japanese).
/usr/bin/jfbterm                                        root:tty          0755

#
# kde
#
# arts wrapper, normally suid root:
/opt/kde3/bin/artswrapper                               root:root         0755
# needs setuid root when using shadow via NIS:
# #66218
/opt/kde3/bin/kcheckpass                                root:shadow       0755
/usr/lib/kde4/libexec/kcheckpass                        root:shadow       0755
/usr/lib64/kde4/libexec/kcheckpass                      root:shadow       0755
# This has a meaning... hmm...
/opt/kde3/bin/kdesud                                    root:nogroup      0755
/usr/lib/kde4/libexec/kdesud                            root:nogroup      0755
/usr/lib64/kde4/libexec/kdesud                          root:nogroup      0755
/usr/lib/libexec/kf5/kdesud                             root:nogroup      0755
/usr/lib64/libexec/kf5/kdesud                           root:nogroup      0755

# used for getting proxy settings from dhcp
/opt/kde3/bin/kpac_dhcp_helper                          root:root         0755
# used to distract the oom killer
# #203535
/opt/kde3/bin/start_kdeinit                             root:root         0755
# bnc#523833
/usr/lib/kde4/libexec/start_kdeinit                     root:root         0755
/usr/lib64/kde4/libexec/start_kdeinit                   root:root         0755
# edits /etc/smb.conf
# #66312
/usr/bin/fileshareset                                   root:root         0755


#
# amanda
#
/usr/lib/amanda/calcsize                                root:amanda       0750
/usr/lib/amanda/rundump                                 root:amanda       0750
/usr/lib/amanda/runtar                                  root:amanda       0750
/usr/lib/amanda/killpgrp                                root:amanda       0750
/usr/lib/amanda/ambind                                  root:amanda       0750
/usr/lib/amanda/application/ambsdtar                    root:amanda       0750
/usr/lib/amanda/application/amgtar                      root:amanda       0750
/usr/lib/amanda/application/amstar                      root:amanda       0750

# postgresql (bsc#1123886)
# This is for older products (<=15.1), in Factory we use better settings. Don't
# port this master
/run/postgresql                                         postgres:postgres 0750
/var/run/postgresql                                     postgres:postgres 0750

#
# gnats
#
/usr/lib/gnats/gen-index                                gnats:root        0555
/usr/lib/gnats/pr-edit                                  gnats:root        0555
/usr/lib/gnats/queue-pr                                 gnats:root        0555


#
# news (inn)
#
# the inn start script changes it's uid to news:news. Later innbind
# is called by this user. Those programs do not need to be called by
# anyone else, therefore the strange permissions 4554 are required
# for operation. (#67032, #594393)
#
/usr/lib/news/bin/rnews                                 news:uucp         0555
/usr/lib/news/bin/inews                                 news:news         0555
/usr/lib/news/bin/innbind                               root:news         0555

#
# sendfax
#
/usr/lib/mgetty+sendfax/faxq-helper                     fax:root          0755
/var/spool/fax/outgoing/                                fax:trusted       0755
/var/spool/fax/outgoing/locks                           fax:trusted       0755

#
# uucp
#
/var/spool/uucppublic/                                  root:uucp         1770
/usr/bin/uucp                                           uucp:uucp         0555
/usr/bin/uuname                                         uucp:uucp         0555
/usr/bin/uustat                                         uucp:uucp         0555
/usr/bin/uux                                            uucp:uucp         0555
/usr/lib/uucp/uucico                                    uucp:uucp         0555
/usr/lib/uucp/uuxqt                                     uucp:uucp         0555

# PolicyKit (#295341)
/usr/lib/PolicyKit/polkit-set-default-helper            root:polkituser   0755
/usr/lib/PolicyKit/polkit-read-auth-helper              root:polkituser   0755
/usr/lib/PolicyKit/polkit-revoke-helper                 root:polkituser   0755
/usr/lib/PolicyKit/polkit-explicit-grant-helper         root:polkituser   0755
/usr/lib/PolicyKit/polkit-grant-helper                  root:polkituser   0755
/usr/lib/PolicyKit/polkit-grant-helper-pam              root:polkituser   0755

# polkit new (bnc#523377)
/usr/lib/polkit-1/polkit-agent-helper-1                 root:root         0755
/usr/bin/pkexec                                         root:root         0755

# dbus-1 (#333361)
/lib/dbus-1/dbus-daemon-launch-helper                   root:messagebus   0750
/lib64/dbus-1/dbus-daemon-launch-helper                 root:messagebus   0750
# dbus-1 in /usr #1056764)
/usr/lib/dbus-1/dbus-daemon-launch-helper               root:messagebus   0750
/usr/lib64/dbus-1/dbus-daemon-launch-helper             root:messagebus   0750

# policycoreutils (#440596)
/usr/bin/newrole                                        root:root         0755

# VirtualBox (#429725)
/usr/lib/virtualbox/VirtualBox                          root:vboxusers    0755
# bsc#1120650
/usr/lib/virtualbox/VirtualBoxVM                        root:vboxusers    0750
/usr/lib/virtualbox/VBoxHeadless                        root:vboxusers    0755
/usr/lib/virtualbox/VBoxSDL                             root:vboxusers    0755
# (bnc#533550)
/usr/lib/virtualbox/VBoxNetAdpCtl                       root:vboxusers    0755
# bnc#669055
/usr/lib/virtualbox/VBoxNetDHCP                         root:vboxusers    0755
# bsc#1033425
/usr/lib/virtualbox/VBoxNetNAT                          root:vboxusers    0755


# open-vm-tools (bnc#474285)
/usr/bin/vmware-user-suid-wrapper			root:root         0755

# lockdev (bnc#588325)
/usr/sbin/lockdev                                       root:lock         0755

# hawk (bnc#665045)
/usr/sbin/hawk_chkpwd                                   root:haclient     0755
/usr/sbin/hawk_invoke                                   root:haclient     0755

# chromium (bnc#718016)
/usr/lib/chrome_sandbox                                 root:root         0755

# ecryptfs-utils (bnc#740110)
/sbin/mount.ecryptfs_private                            root:root         0755

# wireshark (bsc#957624)
/usr/bin/dumpcap					root:root	  0755

# singularity (bsc#1028304)
# these have been dropped in version 2.4 (see bsc#1111411, comment 4)
#/usr/lib/singularity/bin/expand-suid			root:singularity  0750
#/usr/lib/singularity/bin/create-suid			root:singularity  0750
#/usr/lib/singularity/bin/export-suid			root:singularity  0750
#/usr/lib/singularity/bin/import-suid			root:singularity  0750
/usr/lib/singularity/bin/action-suid			root:singularity  0750
/usr/lib/singularity/bin/mount-suid			root:singularity  0750
/usr/lib/singularity/bin/start-suid			root:singularity  0750
# singularity version 3 (bsc#1128598)
/usr/lib/singularity/bin/starter-suid                   root:singularity  0750

# apptainer (Singularity successor) (bsc#1196145)
/usr/lib/apptainer/bin/starter-suid                     root:apptainer    0750

#
# XXX: / -> /usr merge and sbin -> bin merge
# XXX: duplicated entries need to be cleaned up before 12.2
/usr/bin/su                                             root:root         0755
# temporary hack to make the move from coreutils to util-linux work
/usr/bin/su.core                                        root:root         0755
/usr/sbin/mount.nfs                                     root:root         0755
/usr/bin/mount.nfs                                      root:root         0755
/usr/bin/mount                                          root:root         0755
/usr/bin/umount                                         root:root         0755
/usr/sbin/unix_chkpwd                                   root:shadow       0755
/usr/bin/unix_chkpwd                                    root:shadow       0755
/usr/sbin/unix2_chkpwd                                  root:shadow       0755
/usr/bin/unix2_chkpwd                                   root:shadow       0755
/usr/sbin/isdnctrl                                      root:dialout      0755
/usr/bin/isdnctrl                                       root:dialout      0755
/usr/sbin/pccardctl                                     root:trusted      0755
/usr/bin/pccardctl                                      root:trusted      0755

# cdrecord of cdrtools from Joerg Schilling (bnc#550021)
# in paranoid mode, no provisions are made for reliable cd burning, as admins
# will have very likely prohibited that anyway.
/usr/bin/cdrecord                                       root:root       755
/usr/bin/readcd                                         root:root       755
/usr/bin/cdda2wav                                       root:root       755

# qemu-bridge-helper has no special privileges currently (bnc#765948)
/usr/lib/qemu-bridge-helper				root:root	755
/usr/lib64/qemu-bridge-helper				root:root	755


# systemd-journal (bnc#888151)
/var/log/journal/                                       root:systemd-journal	2755

#iouyap (bnc#904060)
/usr/lib/iouyap						root:iouyap	0750

# radosgw (bsc#943471)
/usr/bin/radosgw					root:root	0755

# gstreamer ptp (bsc#960173)
/usr/lib/gstreamer-1.0/gst-ptp-helper			root:root	0755
 +capabilities cap_net_bind_service=ep


#
# suexec is only secure if the document root doesn't contain files
# writeable by wwwrun. Make sure you have a safe server setup
# before setting the setuid bit! See also
# https://bugzilla.novell.com/show_bug.cgi?id=263789
# http://httpd.apache.org/docs/trunk/suexec.html
# You need to override this in permissions.local.
# suexec2 is a symlink for now, leave as-is
#
/usr/sbin/suexec            				root:root       0755

# newgidmap / newuidmap (bsc#979282, bsc#1048645)
/usr/bin/newgidmap					root:shadow	0755
/usr/bin/newuidmap					root:shadow	0755

# kwayland (bsc#1062182)
/usr/bin/kwin_wayland					root:root	0755

# gvfs (bsc#1065864)
/usr/lib/gvfs/gvfsd-nfs                                 root:root       0755

# icinga2 (bsc#1069410)
/run/icinga2/cmd					icinga:icingacmd 0750

# fping (bsc#1047921)
/usr/sbin/fping                                         root:root       0755

# usbauth (bsc#1066877)
/usr/bin/usbauth-npriv                                  root:usbauth    0750
/usr/lib/usbauth-notifier                               root:usbauth-notifier  0750
/usr/lib/usbauth-notifier/usbauth-notifier              root:usbauth    0755

# spice-gtk (bsc#1101420)
/usr/bin/spice-client-glib-usb-acl-helper               root:kvm        0750

# smc-tools (bsc#1102956)
/usr/lib/libsmc-preload.so                              root:root       0755
/usr/lib64/libsmc-preload.so                            root:root       0755

# lxc (bsc#988348)
/usr/lib/lxc/lxc-user-nic                               root:kvm        0750

# firejail (bsc#1059013)
/usr/bin/firejail                                       root:firejail   0750

# authbind (bsc#1111251)
/usr/lib/authbind/helper                                root:root       0755

# fuse3 (bsc#1111230)
/usr/bin/fusermount3                                    root:trusted    0755

# 389-ds (bsc#1111564)
/usr/sbin/ns-slapd					root:dirsrv	0750

# mariadb auth_pam_tool (bsc#1160285)
/usr/lib/mysql/plugin/auth_pam_tool_dir/auth_pam_tool    root:root         0755
/usr/lib64/mysql/plugin/auth_pam_tool_dir/auth_pam_tool  root:root         0755

# Workload Memory Protection (bsc#1161335)
/usr/lib/sapwmp/sapwmp-capture                           root:sapsys    0750

# s390-tools log directory for ts-shell (bsc#1167163)
/var/log/ts-shell/                                      root:ts-shell     0770

# binary that launches texlive tools with group "mktex" (bsc#1171686)
/usr/lib/mktex/public                                   root:mktex 0755

# enlightenment privileged desktop operations (bsc#1169238)
/usr/lib/enlightenment/utils/enlightenment_system       root:root  0755
/usr/lib64/enlightenment/utils/enlightenment_system     root:root  0755

# setuid bit for cockpit (bsc#1169614 bsc#1228548 bsc#1229329)
/usr/lib/cockpit-session                                root:cockpit-wsinstance  0750

# ksysguard network helper (bsc#1151190)
/usr/lib/libexec/ksysguard/ksgrd_network_helper             root:root       0755
/usr/lib64/libexec/ksysguard/ksgrd_network_helper             root:root       0755

# postfix (bsc#1201385)
/usr/sbin/postlog                                       root:maildrop 0755
