World Write Permission on cgroup.event_control

luisfeg — Tue, 29 Oct 2019 19:01:22 GMT

I like to change file permissions for security hardening

These files have 'w' bit in others, is it possible to change to 220 manually?

--w--w--w- 1 root root 0 Oct 29 18:41 /var/run/cloudera-scm-agent/cgroups/memory/<service_name>/cgroup.event_control
--w--w--w- 1 root root 0 Oct 29 18:43 /var/run/cloudera-scm-agent/cgroups/memory/<service_name>/cgroup.event_control

These files are newly created every time that the service is started, can permissions be set to 220 permanently instead of manually?

This change may cause problems with the service?

Thanks

Re: World Write Permission on cgroup.event_control

Robert Justice — Tue, 29 Oct 2019 18:55:10 GMT

Hello @luisfeg,

The files are only listed in the security scan out if the cgroups feature is in effect (CM -> Hosts -> Configuration -> "Enable Cgroup-based Resource Management"). The default permission of the cgroup_event_control files are indeed world writable without any other permission bit set. However, this has not too much effect in accordance with this document which explains why cgroup files are typically world writable: https://www.kernel.org/doc/Documentation/cgroup-v1/memory.txt

This seems to be created by the supervisor code cgroups feature, and Red Hat appears to have a subscription article on a similar concern elsewhere on the file system: https://access.redhat.com/solutions/377043. These files being world writable is an inherent part of Linux cgroups and users being able to use the cgroup API. Cloudera can only use this cgroup feature if the user configures it explicitly thru Cloudera Manager. As Red Hat states in the document mentioned above:

"Changing the world writable bit is not recommended on these files as it would break notification features of the cgroup API. Changing the permissions would have no effect. Cgroups has it's own pseudo-file-system and manages all the files therein. Each time the cgconfig init script is run, the world writable bit will be set on these files. The cgroup.event_control files are world writeable. This is because they are used in conjunction with the cgroups notification API to allow notifications to be sent about a changing status in the control group."

question World Write Permission on cgroup.event_control in Support Questions

World Write Permission on cgroup.event_control

Re: World Write Permission on cgroup.event_control