From owner-freebsd-questions@FreeBSD.ORG Fri Feb 10 18:56:13 2006 Return-Path: X-Original-To: freebsd-questions@freebsd.org Delivered-To: freebsd-questions@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id E7A9416A420 for ; Fri, 10 Feb 2006 18:56:13 +0000 (GMT) (envelope-from freebsd-questions-local@be-well.ilk.org) Received: from mail8.sea5.speakeasy.net (mail8.sea5.speakeasy.net [69.17.117.10]) by mx1.FreeBSD.org (Postfix) with ESMTP id 9930643D48 for ; Fri, 10 Feb 2006 18:56:13 +0000 (GMT) (envelope-from freebsd-questions-local@be-well.ilk.org) Received: (qmail 1681 invoked from network); 10 Feb 2006 18:56:12 -0000 Received: from dsl092-078-145.bos1.dsl.speakeasy.net (HELO be-well.ilk.org) ([66.92.78.145]) (envelope-sender ) by mail8.sea5.speakeasy.net (qmail-ldap-1.03) with SMTP for ; 10 Feb 2006 18:56:12 -0000 Received: by be-well.ilk.org (Postfix, from userid 1147) id 4741B28439; Fri, 10 Feb 2006 13:56:12 -0500 (EST) Sender: lowell@be-well.ilk.org To: Alex Renn References: <358523811.20060209192506@TXnet.com> From: Lowell Gilbert Date: 10 Feb 2006 13:56:12 -0500 In-Reply-To: <358523811.20060209192506@TXnet.com> Message-ID: <44y80jyreb.fsf@be-well.ilk.org> Lines: 26 User-Agent: Gnus/5.09 (Gnus v5.9.0) Emacs/21.3 MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Cc: freebsd-questions@freebsd.org Subject: Re: CD installation and file flags X-BeenThere: freebsd-questions@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list Reply-To: freebsd-questions@freebsd.org List-Id: User questions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 10 Feb 2006 18:56:14 -0000 Alex Renn writes: > I installed FreeBSD 6.0 from CD and noticed that file flags were not > applied by default to /boot, /bin, /sbin. Right. suid files get the flags, but nothing else. > I set kernel_securelevel to 3 but it does not help a lot while there > are no schg flags on system files. File flags are enforced at a securelevel of 1. If they are all you care about, then there's no reason to add the filesystem mounting, clock, and firewall restrictions of levels 2 and 3. > Is there any script to set proper flags for all files in the default > installation? There is not widespread agreement on the definition of "proper" in that sentence. Once you have a precise idea of what you think it should be, writing a script for your particular needs will be trivial. Be well. -- Lowell Gilbert, embedded/networking software engineer, Boston area http://be-well.ilk.org/~lowell/