Insecure permissions nagios service

[nnelson-nagios]

This patch changes the permissions of the systemd unit file for Nagios from 755 to 644. The system is vulnerable because there are systemd unit files with insecure permissions. Systemd unit file permission are considered insecure in the following situations:

• At least one of user, group and others has an execute permission bit.
• Others has a write permission bit.
• Group has a write permission bit.

Making these changes are due to security concerns for Nagios XI which uses Nagios Core. Switching 755 to 644 permissions removes the execution bits from all the groups thus making the systemd unit files secure.

https://www.baeldung.com/linux/systemd-unit-file-permissions

https://docs.redhat.com/en/documentation/red_hat_enterprise_linux/9/html/using_systemd_unit_files_to_customize_and_optimize_your_system/assembly_working-with-systemd-unit-files_working-with-systemd#proc_creating-custom-unit-files_assembly_working-with-systemd-unit-files

[dougnazar]

Unfortunately, that will break other init types than systemd. That Makefile recipe is used for all types, the INIT_DIR & INIT_FILE being decided by AX_NAGIOS_GET_INIT & AX_NAGIOS_GET_PATHS.

It looks like install-daemoninit:, just under that, has an exception to modify the perms for systemd but also runs various commands that shouldn't be run for packaging. You might want to add a similar systemd check to install-init: and conditionally use the different perms.

[nnelson-nagios]

Unfortunately, that will break other init types than systemd. That Makefile recipe is used for all types, the INIT_DIR & INIT_FILE being decided by AX_NAGIOS_GET_INIT & AX_NAGIOS_GET_PATHS.

It looks like install-daemoninit:, just under that, has an exception to modify the perms for systemd but also runs various commands that shouldn't be run for packaging. You might want to add a similar systemd check to install-init: and conditionally use the different perms.

Thank you for your review I greatly appreciated it. I did some further investigation and found a way to solve this issue without modify Nagios Core.