Skip site navigation (1)Skip section navigation (2) 
Date:      Fri, 16 Jun 2017 07:25:31 -0500
From:      Karl Denninger <karl@denninger.net>
To:        FreeBSD-STABLE Mailing List <freebsd-stable@freebsd.org>
Subject:   Interesting permissions difference on NanoBSD build
Message-ID:  <a6e9db4f-235e-bd40-e361-a8af84a68186@denninger.net>
next in thread | raw e-mail | index | archive | help 

[-- Attachment #1 --]
I've recently started playing with the "base" NanoBSD scripts and have
run into an interesting issue.

Specifically, this is what winds up in the "_.w" (world) directory base
when the build completes:

root@NewFS:/pics/Crochet-work-AMD/obj/_.w # ls -al
total 112
drwxr-x---  18 root  wheel    24 Jun 15 17:10 .
drwxr-xr-x   5 root  wheel    24 Jun 15 17:11 ..
-rw-r--r--   2 root  wheel   955 Jun 15 17:09 .cshrc
-rw-r--r--   2 root  wheel   247 Jun 15 17:09 .profile
-r--r--r--   1 root  wheel  6197 Jun 15 17:09 COPYRIGHT
drwxr-xr-x   2 root  wheel    47 Jun 15 17:08 bin
drwxr-xr-x   8 root  wheel    51 Jun 15 17:09 boot
-rw-r--r--   1 root  wheel    12 Jun 15 17:09 boot.config
drwxr-xr-x   2 root  wheel     2 Jun 15 17:09 cfg
drwxr-xr-x   4 root  wheel     4 Jun 15 17:10 conf
dr-xr-xr-x   2 root  wheel     3 Jun 15 17:09 dev
drwxr-x--x  28 root  wheel   110 Jun 15 17:10 etc
drwxr-xr-x   4 root  wheel    56 Jun 15 17:08 lib
drwxr-xr-x   3 root  wheel     5 Jun 15 17:09 libexec
drwxr-xr-x   2 root  wheel     2 Jun 15 17:07 media
drwxr-xr-x   2 root  wheel     2 Jun 15 17:07 mnt
dr-xr-xr-x   2 root  wheel     2 Jun 15 17:07 proc
drwxr-xr-x   2 root  wheel   146 Jun 15 17:08 rescue
drwxr-xr-x   2 root  wheel    12 Jun 15 17:10 root
drwxr-xr-x   2 root  wheel   137 Jun 15 17:08 sbin
lrwxr-xr-x   1 root  wheel    11 Jun 15 17:07 sys -> usr/src/sys
lrwxr-xr-x   1 root  wheel     7 Jun 15 17:10 tmp -> var/tmp
drwxr-x--x  12 root  wheel    12 Jun 15 17:10 usr
drwxr-xr-x  25 root  wheel    25 Jun 15 17:10 var
root@NewFS:/pics/Crochet-work-AMD/obj/_.w #

Note the missing "r" bit for "other" in usr and etc directories -- and
the missing "x" bit (at minimum) for the root!  The same is carried down
to "local" under usr:

root@NewFS:/pics/Crochet-work-AMD/obj/_.w # ls -al usr
total 134
drwxr-x--x  12 root  wheel   12 Jun 15 17:10 .
drwxr-x---  18 root  wheel   24 Jun 15 17:10 ..
drwxr-xr-x   2 root  wheel  497 Jun 15 17:09 bin
drwxr-xr-x  52 root  wheel  327 Jun 15 17:10 include
drwxr-xr-x   8 root  wheel  655 Jun 15 17:10 lib
drwxr-xr-x   4 root  wheel  670 Jun 15 17:09 lib32
drwxr-xr-x   5 root  wheel    5 Jun 15 17:10 libdata
drwxr-xr-x   7 root  wheel   70 Jun 15 17:10 libexec
drwxr-x--x  10 root  wheel   11 Jun 15 17:10 local
drwxr-xr-x   2 root  wheel  294 Jun 15 17:08 sbin
drwxr-xr-x  31 root  wheel   31 Jun 15 17:10 share
drwxr-xr-x  14 root  wheel   17 Jun 15 17:10 tests
root@NewFS:/pics/Crochet-work-AMD/obj/_.w #

I do not know if this is intentional, but it certainly was not
expected.  It does carry through to the disk image that is created as
well and then there's this, which if you mount the image leads me to
wonder what's going on:

root@NewFS:/pics/Crochet-work-AMD/obj # mount -o ro /dev/md0s1a /mnt
root@NewFS:/pics/Crochet-work-AMD/obj # cd /mnt
root@NewFS:/mnt # ls -al
total 34
drwxr-x---  19 root  wheel      512 Jun 15 17:10 .
drwxr-xr-x  45 root  wheel       55 Jun  1 10:58 ..
-rw-r--r--   2 root  wheel      955 Jun 15 17:09 .cshrc
-rw-r--r--   2 root  wheel      247 Jun 15 17:09 .profile
drwxrwxr-x   2 root  operator   512 Jun 15 17:10 .snap
-r--r--r--   1 root  wheel     6197 Jun 15 17:09 COPYRIGHT
drwxr-xr-x   2 root  wheel     1024 Jun 15 17:08 bin
drwxr-xr-x   8 root  wheel     1024 Jun 15 17:09 boot
-rw-r--r--   1 root  wheel       12 Jun 15 17:09 boot.config
drwxr-xr-x   2 root  wheel      512 Jun 15 17:09 cfg
drwxr-xr-x   4 root  wheel      512 Jun 15 17:10 conf
dr-xr-xr-x   2 root  wheel      512 Jun 15 17:09 dev
drwxr-x--x  28 root  wheel     2048 Jun 15 17:10 etc
drwxr-xr-x   4 root  wheel     1536 Jun 15 17:08 lib
drwxr-xr-x   3 root  wheel      512 Jun 15 17:09 libexec
drwxr-xr-x   2 root  wheel      512 Jun 15 17:07 media
drwxr-xr-x   2 root  wheel      512 Jun 15 17:07 mnt
dr-xr-xr-x   2 root  wheel      512 Jun 15 17:07 proc
drwxr-xr-x   2 root  wheel     2560 Jun 15 17:08 rescue
drwxr-xr-x   2 root  wheel      512 Jun 15 17:10 root
drwxr-xr-x   2 root  wheel     2560 Jun 15 17:08 sbin
lrwxr-xr-x   1 root  wheel       11 Jun 15 17:07 sys -> usr/src/sys
lrwxr-xr-x   1 root  wheel        7 Jun 15 17:10 tmp -> var/tmp
drwxr-x--x  12 root  wheel      512 Jun 15 17:10 usr
drwxr-xr-x  25 root  wheel      512 Jun 15 17:10 var

Note the permissions at the root -- that denies *search* for others....
it is an exact copy of the "_.w" permission list of course, but if you
create a non-root user as a part of the NanoBSD build you wind up with
some "interesting" behavior when that user logs in!

I'm assuming this is unintentional but wondering where it comes from
(and whether it needs / should be fixed); it's easy to fix it, of
course, once the embedded system boots but you need to (obviously) mount
read/write long enough to update it....

-- 
Karl Denninger
karl@denninger.net <mailto:karl@denninger.net>
/The Market Ticker/
/[S/MIME encrypted email preferred]/

[-- Attachment #2 --]
0	*H
010
	`He0	*H
\0X0@=0
	*H
010	UUS10UFlorida10U	Niceville10U
Cuda Systems LLC10UCuda Systems LLC CA1"0 	*H
	Cuda Systems LLC CA0
161218194535Z
211217194535Z0W10	UUS10UFlorida10U
Cuda Systems LLC10Ukarl@denninger.net0"0
	*H
0
͍fd`1ie6";fSz`5¹/?{=Ӵowjħ_fnӴMG\ҢҖ4ib}>@mJo&mM;
Q9U cj]p퐆W.2E=
^¢tzĄ'5i7_`~#dY
`]R]N%R}EXzqV@[oN	T>5AwYˡA"\v&YG]+($p:M,T?=mJkMљg*ym
L!J[./d׷?W^LysD'1
+V'~{-SSX=q-f=%&V<m4BeSet|
l2m 6iO{wv
+aHXˈ5=~é*C!?uJr3tb'3`Oe)üLxt&3N526llU
.|Cp[l?007++0)0'+0http://cudasystems.net:88880	U00	`HB0U0,	`HB
OpenSSL Generated Certificate0U/Zi
0GhG0U#0$q}ݽʒm50U0karl@denninger.net0
	*H
b%X%gwq	
ɁэrK[DMJ35W6
sz8d|qB2Cyw2PbV}
â[!W{HD7oD.TZ'w6~g( -,]R8P{*[f<1=7jGj9铚~3f2AʺN	k~@vz^j(>ͺyh2y{/9}4.45#S|<fW!.,Bss*Q+h=}l@	"q "M&6J5*,G {hɫjbNgǠ.ЃXȶ4$O.5evHlZba!4eE!x|Za1򹿈nZ5TuPvW|#G+	DZpI7S'n0 haGa@vZ	e|]Cu+))vRyY100010	UUS10UFlorida10U	Niceville10U
Cuda Systems LLC10UCuda Systems LLC CA1"0 	*H
	Cuda Systems LLC CA=0
	`HeM0	*H
	1	*H
0	*H
	1
170616122531Z0O	*H
	1B@{X1P*B@)yO٣azhV-E!EeOkJ&M!0l	*H
	1_0]0	`He*0	`He0
*H
0*H
0
*H
@0+0
*H
(0	+710010	UUS10UFlorida10U	Niceville10U
Cuda Systems LLC10UCuda Systems LLC CA1"0 	*H
	Cuda Systems LLC CA=0*H
	1010	UUS10UFlorida10U	Niceville10U
Cuda Systems LLC10UCuda Systems LLC CA1"0 	*H
	Cuda Systems LLC CA=0
	*H
,=ֱg	ZOb@,rǧ'tμ;$P@8NNNXxwߧ+6JDz	h9;M\Gi#j<te/&]G8ha󋮫Sng9OX#_ќ-8Wd*jlqB+hˊc$;O~^m1!8JHP3(a"w`<1Rz\fp'A
-n1Ts Tr'<'srl#>e0+3b=ElZ8ⷊ}HHzɼCXvzD
[&r`W|
Swo5=FF:/20b{f|j
:˜p3R򳏂ʄ0#fnZx@騸1;e
9xQ8SzTz`(pc
zҒ)؋{ʓdTrmPSclD`4L"

Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?a6e9db4f-235e-bd40-e361-a8af84a68186>