Date: Sun, 06 Aug 2017 18:58:36 +0000 From: bugzilla-noreply@freebsd.org To: freebsd-bugs@FreeBSD.org Subject: [Bug 221289] Setting loader.conf password prevents autoboot, manual boot still okay; password leaked Message-ID: <bug-221289-8-XXN5aFATQc@https.bugs.freebsd.org/bugzilla/> In-Reply-To: <bug-221289-8@https.bugs.freebsd.org/bugzilla/> References: <bug-221289-8@https.bugs.freebsd.org/bugzilla/>
next in thread | previous in thread | raw e-mail | index | archive | help
https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=221289 fred@boyce.za.net changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |fred@boyce.za.net --- Comment #1 from fred@boyce.za.net --- Some additional notes: a. If I remove the 'password="test"' from loader.conf, everything works again. So it does seem to be that when we go through the sys/boot/forth/check-password.4th code path that the environment for autoboot is subtly different. b. Regarding problem 2, I also noticed that the /boot directory and loader.conf are world-readable by default, which leaks the boot password in plain text to any user on the system. Should I raise a separate issue for that? -- You are receiving this mail because: You are the assignee for the bug.
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?bug-221289-8-XXN5aFATQc>