Software Engineering Institute

Mandrake Linux includes a tool named Mandrake Security (msec) that allows system administrators to manage and audit various system parameters associated with host security. These parameters include port-based access control, shell and console timeout values, user and root login policies, password maintenance, and system activity logging. System administrators may choose one of several preset security levels, then specify exceptions to these default policies.

The CERT/CC has learned of a public report which states that the msec security level on a default installation of Mandrake Linux sets the file permissions of each user's home directory to mode 755, allowing full access to the directory owner, read-only access to group members, and read-only access to other users. In addition, the report alleges that if these settings are modified, the msec utility will restore the default settings during a periodic system audit.

Although this utility may result in unexpected behavior, it appears that this behavior accurately maintains the configured security policy and is consistent with the product documentation. Given that the documentation is readily available and the utility allows system administrators to customize the behavior of msec, the CERT/CC does not believe that this utility represents a security vulnerability.

This utility accurately and consistently performs as documented. However, system administrators who do not understand its operation may encounter unexpected behavior.

Read the msec documentation

The CERT/CC encourages system administrators who wish to alter the default behavior of msec to read the product documentation and customize their msec configuration as appropriate.