From owner-cvs-all Mon Feb 12 8:53:10 2001 Delivered-To: cvs-all@freebsd.org Received: from mobile.wemm.org (c1315225-a.plstn1.sfba.home.com [65.0.135.147]) by hub.freebsd.org (Postfix) with ESMTP id BB0CF37B491; Mon, 12 Feb 2001 08:53:05 -0800 (PST) Received: from netplex.com.au (localhost [127.0.0.1]) by mobile.wemm.org (8.11.1/8.11.1) with ESMTP id f1CGr5U51782; Mon, 12 Feb 2001 08:53:05 -0800 (PST) (envelope-from peter@netplex.com.au) Message-Id: <200102121653.f1CGr5U51782@mobile.wemm.org> X-Mailer: exmh version 2.2 06/23/2000 with nmh-1.0.4 To: Robert Watson Cc: Warner Losh , Peter Pentchev , Dag-Erling Smorgrav , cvs-committers@FreeBSD.org, cvs-all@FreeBSD.org Subject: Re: cvs commit: src/sys/vm vm_zone.c vm_zone.h In-Reply-To: Date: Mon, 12 Feb 2001 08:53:05 -0800 From: Peter Wemm Sender: owner-cvs-all@FreeBSD.ORG Precedence: bulk X-Loop: FreeBSD.ORG Robert Watson wrote: > > On Mon, 12 Feb 2001, Peter Wemm wrote: > > > Warner Losh wrote: > > > In message Rob > > ert Watson writes: > > > : appreciated. (this will also make it easier for portable kernel > > > : monitoring tools to be written, and allow graphical monitoring tools to > > > : run with less privilege). > > > > > > And generally make for a happier security officer team :-) > > > > And an unhappier team of people dealing with kernel crashdumps. :-( > > > > All this sysctl stuff is fine, but dont kill the crashdump reading code! > > If -M or -N are specified then use the old way (and require root to be > > running it). Without -M or -N, use sysctl. > > All patches submitted on the freebsd-audit mailing list to remove setgid > from top, systat, dmesg, etc, have maintained backwards compatibility by > using kmem when the -M or -N argument is provided, permitting them to > continue to work on system dumps -- and even on /dev/kmem, it just > requires that you run them as root now, since they won't be setgid kmem. > If you have a few minutes and want to verify that the new versions will > continue to work properly for you, and that you think they're implemented > right, the archives of -audit contain a number of relevant posts by Thomas > Moestl . netstat(1) is a high profile tool that got broken this way and is sorely missed here. At work we reverted the sysctl changes entirely for simplicity. Cheers, -Peter -- Peter Wemm - peter@FreeBSD.org; peter@yahoo-inc.com; peter@netplex.com.au "All of this is for nothing if we don't go to the stars" - JMS/B5 To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe cvs-all" in the body of the message