-
Notifications
You must be signed in to change notification settings - Fork 1.1k
Closed
Description
On a new agent installation of 2.9rc1, I get the following errors:
2016/06/20 16:09:28 ossec-agentd: ERROR: Unable to unmerge file '/etc/shared/cis_rhel_linux_rcl.txt'.
2016/06/20 16:09:28 ossec-agentd: ERROR: Unable to unmerge file '/etc/shared/cis_rhel6_linux_rcl.txt'.
2016/06/20 16:09:28 ossec-agentd: ERROR: Unable to unmerge file '/etc/shared/system_audit_rcl.txt'.
2016/06/20 16:09:28 ossec-agentd: ERROR: Unable to unmerge file '/etc/shared/rootkit_files.txt'.
2016/06/20 16:09:28 ossec-agentd: ERROR: Unable to unmerge file '/etc/shared/win_applications_rcl.txt'.
2016/06/20 16:09:28 ossec-agentd: ERROR: Unable to unmerge file '/etc/shared/cis_debian_linux_rcl.txt'.
2016/06/20 16:09:28 ossec-agentd: ERROR: Unable to unmerge file '/etc/shared/win_audit_rcl.txt'.
2016/06/20 16:09:28 ossec-agentd: ERROR: Unable to unmerge file '/etc/shared/cis_rhel7_linux_rcl.txt'.
2016/06/20 16:09:28 ossec-agentd: ERROR: Unable to unmerge file '/etc/shared/cis_rhel5_linux_rcl.txt'.
2016/06/20 16:09:28 ossec-agentd: ERROR: Unable to unmerge file '/etc/shared/win_malware_rcl.txt'.
2016/06/20 16:09:28 ossec-agentd: ERROR: Unable to unmerge file '/etc/shared/rootkit_trojans.txt'.
I believe these files are installed read only (440):
install -m 0440 -o root -g ${OSSEC_GROUP} rootcheck/db/*.txt ${PREFIX}/etc/shared/
Should this be changed to 640?