From owner-freebsd-bugs@FreeBSD.ORG  Mon Apr 14 13:51:29 2014
Return-Path: <owner-freebsd-bugs@FreeBSD.ORG>
Delivered-To: freebsd-bugs@FreeBSD.org
Received: from mx1.freebsd.org (mx1.freebsd.org [8.8.178.115])
 (using TLSv1 with cipher ADH-AES256-SHA (256/256 bits))
 (No client certificate requested)
 by hub.freebsd.org (Postfix) with ESMTPS id 8467A9C1;
 Mon, 14 Apr 2014 13:51:29 +0000 (UTC)
Received: from deutsche.xocolatl.com (deutsche.xocolatl.com
 [IPv6:2a01:4f8:100:3445::2])
 (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits))
 (Client did not present a certificate)
 by mx1.freebsd.org (Postfix) with ESMTPS id 1ED2A1A2D;
 Mon, 14 Apr 2014 13:51:28 +0000 (UTC)
Received: from smock.frfnet.xocolatl.com (37.130.144.179.radiocable.net
 [37.130.144.179] (may be forged)) (authenticated bits=0)
 by deutsche.xocolatl.com (8.14.8/8.14.8) with ESMTP id s3EDpKtt052350
 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES128-SHA bits=128 verify=NO);
 Mon, 14 Apr 2014 15:51:26 +0200 (CEST) (envelope-from frf@faulds.net)
Message-ID: <534BE7D3.3010601@faulds.net>
Date: Mon, 14 Apr 2014 15:51:15 +0200
From: Robert Faulds <frf@faulds.net>
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.9;
 rv:24.0) Gecko/20100101 Thunderbird/24.4.0
MIME-Version: 1.0
To: jilles@FreeBSD.org, freebsd-bugs@FreeBSD.org
Subject: Re: kern/127048: systat(1) information leak when
 security.bsd.see_other_uids=0
References: <201404132043.s3DKhT8H007733@freefall.freebsd.org>
In-Reply-To: <201404132043.s3DKhT8H007733@freefall.freebsd.org>
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
Content-Transfer-Encoding: 7bit
X-BeenThere: freebsd-bugs@freebsd.org
X-Mailman-Version: 2.1.17
Precedence: list
List-Id: Bug reports <freebsd-bugs.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/options/freebsd-bugs>,
 <mailto:freebsd-bugs-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-bugs/>
List-Post: <mailto:freebsd-bugs@freebsd.org>
List-Help: <mailto:freebsd-bugs-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-bugs>,
 <mailto:freebsd-bugs-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Mon, 14 Apr 2014 13:51:29 -0000

This was fixed many years ago.
Dunno why the bug is still open. I had completely forgotten about it.


Robert

On 4/13/14, 10:43 PM, jilles@FreeBSD.org wrote:
> Synopsis: systat(1) information leak when security.bsd.see_other_uids=0
>
> State-Changed-From-To: open->feedback
> State-Changed-By: jilles
> State-Changed-When: Sun Apr 13 20:41:07 UTC 2014
> State-Changed-Why:
> I tested this on stable/9 and head (11.0) and it appears to work properly.
>
> Either this was fixed since 7.0 or there is something special about
> your environment.
>
> Make sure that /usr/bin/systat does not have setuid/setgid bits set;
> if so, it will read from kernel memory and ignore
> security.bsd.see_other_uids.
>
> Can you provide more information?
>
>
> Responsible-Changed-From-To: freebsd-bugs->jilles
> Responsible-Changed-By: jilles
> Responsible-Changed-When: Sun Apr 13 20:41:07 UTC 2014
> Responsible-Changed-Why:
> Track replies.
>
> http://www.freebsd.org/cgi/query-pr.cgi?pr=127048
>