From owner-freebsd-questions@FreeBSD.ORG Fri Feb 24 14:26:15 2012 Return-Path: Delivered-To: freebsd-questions@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34]) by hub.freebsd.org (Postfix) with ESMTP id 7D4DF1065673 for ; Fri, 24 Feb 2012 14:26:15 +0000 (UTC) (envelope-from trond@fagskolen.gjovik.no) Received: from smtp.fagskolen.gjovik.no (smtp.fagskolen.gjovik.no [IPv6:2001:700:1100:1:200:ff:fe00:b]) by mx1.freebsd.org (Postfix) with ESMTP id C813B8FC14 for ; Fri, 24 Feb 2012 14:26:14 +0000 (UTC) Received: from mail.fig.ol.no (localhost [127.0.0.1]) by mail.fig.ol.no (8.14.5/8.14.5) with ESMTP id q1OEPrGV010514 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO); Fri, 24 Feb 2012 15:25:53 +0100 (CET) (envelope-from trond@fagskolen.gjovik.no) Received: from localhost (trond@localhost) by mail.fig.ol.no (8.14.5/8.14.5/Submit) with ESMTP id q1OEPrG2010511; Fri, 24 Feb 2012 15:25:53 +0100 (CET) (envelope-from trond@fagskolen.gjovik.no) X-Authentication-Warning: mail.fig.ol.no: trond owned process doing -bs Date: Fri, 24 Feb 2012 15:25:52 +0100 (CET) From: =?ISO-8859-1?Q?Trond_Endrest=F8l?= Sender: Trond.Endrestol@fagskolen.gjovik.no To: Anton Shterenlikht In-Reply-To: <20120224140408.GA8384@mech-cluster241.men.bris.ac.uk> Message-ID: References: <20120224090848.GA28104@mech-cluster241.men.bris.ac.uk> <4F47598A.9080400@infracaninophile.co.uk> <20120224125430.GB8026@mech-cluster241.men.bris.ac.uk> <20120224140408.GA8384@mech-cluster241.men.bris.ac.uk> User-Agent: Alpine 2.00 (BSF 1167 2008-08-23) Organization: Fagskolen Innlandet OpenPGP: url=http://fig.ol.no/~trond/trond.key MIME-Version: 1.0 Content-Type: MULTIPART/MIXED; BOUNDARY="2055831798-565157545-1330093553=:47275" X-Spam-Status: No, score=-2.8 required=5.0 tests=ALL_TRUSTED,AWL,BAYES_00 autolearn=ham version=3.3.2 X-Spam-Checker-Version: SpamAssassin 3.3.2 (2011-06-06) on mail.fig.ol.no Cc: FreeBSD questions Subject: Re: negative group permissions? X-BeenThere: freebsd-questions@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: User questions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 24 Feb 2012 14:26:15 -0000 This message is in MIME format. The first part should be readable text, while the remaining parts are likely unreadable without MIME-aware tools. --2055831798-565157545-1330093553=:47275 Content-Type: TEXT/PLAIN; charset=ISO-8859-1 Content-Transfer-Encoding: 8BIT On Fri, 24 Feb 2012 14:04-0000, Anton Shterenlikht wrote: > On Fri, Feb 24, 2012 at 02:41:44PM +0100, Trond Endrest?l wrote: > > On Fri, 24 Feb 2012 12:54-0000, Anton Shterenlikht wrote: > > > > > On Fri, Feb 24, 2012 at 09:34:02AM +0000, Matthew Seaman wrote: > > > > On 24/02/2012 09:08, Anton Shterenlikht wrote: > > > > > Recently I started seeing this line > > > > > in daily security output: > > > > > > > > > > Checking negative group permissions: > > > > > 70834 -rw-r----x 1 root daemon 4 Feb 21 12:54:02 2012 /var/spool/output/lpd/.seq > > > > > > > > > > I've a parallel printer attached to > > > > > a 9.9-CURRENT #2 r230787M box. > > > > > > > > > > What does it mean? > > > > > > > > This means that non-root users in group daemon have only read > > > > permissions on that file. Users that aren't root and that aren't in > > > > group daemon have execute permission only. > > > > > > > > It does look a bit odd, and I believe that file would just contain a job > > > > number (IIRC -- haven't dealt much with lpd or lprng much recently) > > > > so executing it doesn't really achieve anything. > > > > > > > > This is the standard idiom to allow access for 'everyone, except members > > > > of a particular group.' > > > > > > yes, I get this. > > > > > > > > > > One way you can get weird permissions is if you happen to use decimal > > > > for permissions bitmaps rather than octal. A umask of '77' is not the > > > > same thing at all as a umask of '077'. (It's effectively 0115, which > > > > doesn't make much sense to me.) Most shells nowadays will assume you > > > > mean octal whether you include the leading zero or not: the same is not > > > > true if you use umask(2) to set the mask programatically. Ditto for > > > > other places you can set permissions like open(2) with O_CREAT or mkdir(2). > > > > > > # umask > > > 0022 > > > # pwd > > > /var/spool/output/lpd > > > # ls -al > > > total 8 > > > drwxr-xr-x 2 root daemon 512 Feb 24 12:43 . > > > drwxr-xr-x 3 root daemon 512 Mar 9 2010 .. > > > -rw-rw-r-- 1 root daemon 41 Feb 21 12:54 lock > > > -rw-rw-r-- 1 root daemon 25 Feb 21 12:54 status > > > # > > > > > > Then I print something: > > > > > > % pwd | lpr > > > > > > Then this .seq file appears with weird permissions: > > > > > > # ls -al > > > total 10 > > > drwxr-xr-x 2 root daemon 512 Feb 24 12:46 . > > > drwxr-xr-x 3 root daemon 512 Mar 9 2010 .. > > > -rw-r----x 1 root daemon 4 Feb 24 12:45 .seq > > > -rw-rw-r-- 1 root daemon 41 Feb 24 12:45 lock > > > -rw-rw-r-- 1 root daemon 25 Feb 24 12:45 status > > > # > > > > > > # cat .seq > > > 001 > > > # > > > > > > So presumably lpd(8) created this file, but I'm still > > > unsure why permissions are so strange. But interests > > > me more, is why I didn't see it until about 1-2 months > > > ago? Has something chaged in -current, e.g. in open(2) > > > like you suggest? Or has I messed up with my setup? > > > Or maybe it was always like this, but the security > > > check didn't pick it up? > > > > > > > > > > > > Should I be worried? > > > > > > > > No more than a normal level of paranoia is indicated here. > > > > Looking at usr.sbin/lpr/lpr/lpr.c at around line 847 (RELENG_9): > > > > (void) snprintf(buf, sizeof(buf), "%s/.seq", pp->spool_dir); > > seteuid(euid); > > if ((fd = open(buf, O_RDWR|O_CREAT, 0661)) < 0) { > > printf("%s: cannot create %s\n", progname, buf); > > exit(1); > > } > > if (flock(fd, LOCK_EX)) { > > printf("%s: cannot lock %s\n", progname, buf); > > exit(1); > > } > > > > It remains a mystery why these files are created with mode 0661. Mode > > Isn't .seq above has mode 641? > > % chmod 641 z > % ls -al z > -rw-r----x 1 mexas wheel 0 Feb 24 13:59 z > % It sure is, in all cases quoted above. All handling of the .seq files seems to be contained within the mktemps() function of usr.sbin/lpr/lpr/lpr.c. The call to open(2) with the mode set to 0661 has been there since CVS revision 1.1 of usr.sbin/lpr/lpr/lpr.c, see http://www.freebsd.org/cgi/cvsweb.cgi/src/usr.sbin/lpr/lpr/lpr.c?annotate=1.45.2.1.2.1 No calls to chmod(2) of the .seq files anywhere else, as far as I can tell. I usually keep tight permissions on the spool directories, mode 0770. It's still a mystery. Thus it's time to bring in people with more knowledge on lpr and friends. -- +-------------------------------+------------------------------------+ | Vennlig hilsen, | Best regards, | | Trond Endrestøl, | Trond Endrestøl, | | IT-ansvarlig, | System administrator, | | Fagskolen Innlandet, | Gjøvik Technical College, Norway, | | tlf. dir. 61 14 54 39, | Office.....: +47 61 14 54 39, | | tlf. mob. 952 62 567, | Cellular...: +47 952 62 567, | | sentralbord 61 14 54 00. | Switchboard: +47 61 14 54 00. | +-------------------------------+------------------------------------+ --2055831798-565157545-1330093553=:47275--