#693707 tiger complains about /usr/local's default group and permissions

Package:
tiger
Source:
tiger
Description:
security auditing and intrusion detection tools for Linux
Submitter:
Francois Gouget
Date:
2012-11-19 15:09:04 UTC
Severity:
normal
#693707#5
Date:
2012-11-19 15:05:54 UTC
From:
To:
Dear Maintainer,

I have local scripts that I invoke from cron. Since these are local their rightful place is in /usr/local. But that causes the following Tiger complaints:

# Performing check of `cron' entries...
NEW: --WARN-- [cron003] cron entry for root uses `/usr/local/bin/anice' which contains `/usr/local' which is group `staff' writable.
NEW: --WARN-- [cron003] cron entry for root uses `/usr/local/bin/anice' which contains `/usr/local/bin' which is group `staff' writable.
NEW: --WARN-- [cron003] cron entry for root uses `/usr/local/sbin/local-backup-all' which contains `/usr/local' which is group `staff' writable.
NEW: --WARN-- [cron003] cron entry for root uses `/usr/local/sbin/local-backup-all' which contains `/usr/local/sbin' which is group `staff' writable.

No package appears to own these directories but I checked on a brand new Debian 6.0.6 install and have confirmed that they were created by Debian with precisely this group ownership and permissions. This means we have one part of Debian complaining another part of Debian is wrong.

So either Tiger should be modified to not complain about these permissions, or the Debian installer, and probably Debian policy too, should be modified to use settings more palatable to Tiger.

For reference here is the output of 'ls -ld' on these directories:

drwxrwsr-x 10 root staff 4096 juil. 20  2011 /usr/local/
drwxrwsr-x  3 root staff 4096 oct.  16 18:30 /usr/local/bin/
drwxrwsr-x  2 root staff 4096 juin  23  2008 /usr/local/etc/
drwxrwsr-x  2 root staff 4096 juin  23  2008 /usr/local/games/
drwxrwsr-x  2 root staff 4096 juin  23  2008 /usr/local/include/
drwxrwsr-x  7 root staff 4096 nov.   7 11:15 /usr/local/lib/
lrwxrwxrwx  1 root staff    9 juin  23  2008 /usr/local/man -> share/man/
drwxrwsr-x  2 root staff 4096 nov.  18 02:55 /usr/local/sbin/
drwxrwsr-x 11 root staff 4096 oct.   1 10:58 /usr/local/share/
drwxrwsr-x  2 root staff 4096 juin  23  2008 /usr/local/src/