From owner-cvs-all@FreeBSD.ORG Thu Jan 13 19:34:17 2005 Return-Path: Delivered-To: cvs-all@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id A244216A4CE for ; Thu, 13 Jan 2005 19:34:17 +0000 (GMT) Received: from mail15.speakeasy.net (mail23.sea5.speakeasy.net [69.17.117.25]) by mx1.FreeBSD.org (Postfix) with ESMTP id ED8A243D45 for ; Thu, 13 Jan 2005 19:34:16 +0000 (GMT) (envelope-from jmg@hydrogen.funkthat.com) Received: (qmail 1717 invoked from network); 13 Jan 2005 19:34:16 -0000 Received: from gate.funkthat.com (HELO hydrogen.funkthat.com) ([69.17.45.168]) (envelope-sender ) by mail15.speakeasy.net (qmail-ldap-1.03) with SMTP for ; 13 Jan 2005 19:34:16 -0000 Received: from hydrogen.funkthat.com (tuxoxq@localhost.funkthat.com [127.0.0.1])j0DJYFGH058557; Thu, 13 Jan 2005 11:34:15 -0800 (PST) (envelope-from jmg@hydrogen.funkthat.com) Received: (from jmg@localhost) by hydrogen.funkthat.com (8.12.10/8.12.10/Submit) id j0DJYDc6058556; Thu, 13 Jan 2005 11:34:13 -0800 (PST) Date: Thu, 13 Jan 2005 11:34:13 -0800 From: John-Mark Gurney To: Giorgos Keramidas Message-ID: <20050113193413.GL19624@funkthat.com> References: <20050113153228.GG49329@submonkey.net> <200501131849.j0DInEEE029957@gw.catspoiler.org> <20050113185323.GI49329@submonkey.net> <20050113190755.GA24939@orion.daedalusnetworks.priv> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <20050113190755.GA24939@orion.daedalusnetworks.priv> User-Agent: Mutt/1.4.1i X-Operating-System: FreeBSD 4.2-RELEASE i386 X-PGP-Fingerprint: B7 EC EF F8 AE ED A7 31 96 7A 22 B3 D8 56 36 F4 X-Files: The truth is out there X-URL: http://resnet.uoregon.edu/~gurney_j/ X-Resume: http://resnet.uoregon.edu/~gurney_j/resume.html cc: src-committers@FreeBSD.org cc: cvs-src@FreeBSD.org cc: Don Lewis cc: cvs-all@FreeBSD.org cc: glebius@FreeBSD.org cc: Ceri Davies Subject: Re: cvs commit: src/etc/periodic/security 100.chksetuid X-BeenThere: cvs-all@freebsd.org X-Mailman-Version: 2.1.1 Precedence: list Reply-To: John-Mark Gurney List-Id: CVS commit messages for the entire tree List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 13 Jan 2005 19:34:18 -0000 Giorgos Keramidas wrote this message on Thu, Jan 13, 2005 at 21:07 +0200: > > Sounds like something like chksetuid_exclude which lists mountpoints to > > exclude might be in order. Any objections to me putting that together, > > or are people happy with the status quo? > > It's not a bad idea. While you're at it, a knob that disables checks > for NFS-mounted filesystems may be nice too. It doesn't make sense to > check the same files both in the client *and* the server, as Don has > pointed out. > > I think I can almost see this coming :-) > > daily_status_security_chksetuid_nfs="NO" Why not do something like: daily_status_security_chksetuid_remote="NO" Find already has "logic" that tries to determin if an fs is local or remote.. -- John-Mark Gurney Voice: +1 415 225 5579 "All that I will do, has been done, All that I have, has not."