Date: Tue, 2 Apr 2002 14:40:39 -0600 From: ryan beasley <ryanb@goddamnbastard.org> To: freebsd-audit@FreeBSD.Org Subject: [patch] mtree(8) inode number tracking support Message-ID: <20020402204039.GE34680@bjorn.goddamnbastard.org>
next in thread | raw e-mail | index | archive | help
--BZaMRJmqxGScZ8Mx
Content-Type: multipart/mixed; boundary="SO98HVl1bnMOfKZd"
Content-Disposition: inline
--SO98HVl1bnMOfKZd
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable
Hi!
The following patch adds support for tracking inode number changes
to mtree(8). It seems like a good idea for those using mtree as the
poor-man's Tripwire. (Forgot who coined that phrase. :/)
(Patch made against mid-February RELENG_4. Also attached is an
excerpt of a mtree "session" to show output for differing inodes.)
Thoughts?
--=20
ryan beasley <ryanb@goddamnbastard.org>
professional fat bastard http://www.goddamnbastard.org
GPG ID 0x36321D13
--SO98HVl1bnMOfKZd
Content-Type: text/plain; charset=us-ascii
Content-Disposition: attachment; filename="mtree.inode.patch"
Content-Transfer-Encoding: quoted-printable
Common subdirectories: src/usr.sbin/mtree.orig/CVS and src/usr.sbin/mtree/C=
VS
diff -u src/usr.sbin/mtree.orig/compare.c src/usr.sbin/mtree/compare.c
--- src/usr.sbin/mtree.orig/compare.c Fri Jan 12 13:17:18 2001
+++ src/usr.sbin/mtree/compare.c Fri Mar 29 08:28:16 2002
@@ -178,6 +178,12 @@
tab, s->st_size, p->fts_statp->st_size);
tab =3D "\t";
}
+ if (s->flags & F_INUM && s->st_ino !=3D p->fts_statp->st_ino) {
+ LABEL;
+ (void)printf("%sinode expected %u found %u\n",
+ tab, s->st_ino, p->fts_statp->st_ino);
+ tab =3D "\t";
+ }
/*
* XXX
* Catches nano-second differences, but doesn't display them.
diff -u src/usr.sbin/mtree.orig/create.c src/usr.sbin/mtree/create.c
--- src/usr.sbin/mtree.orig/create.c Fri Jan 12 13:17:18 2001
+++ src/usr.sbin/mtree/create.c Fri Mar 29 08:31:24 2002
@@ -218,6 +218,8 @@
(void)close(fd);
output(indent, &offset, "cksum=3D%lu", val);
}
+ if (keys & F_INUM)
+ output(indent, &offset, "inum=3D%u", p->fts_statp->st_ino);
#ifdef MD5
if (keys & F_MD5 && S_ISREG(p->fts_statp->st_mode)) {
char *digest, buf[33];
diff -u src/usr.sbin/mtree.orig/misc.c src/usr.sbin/mtree/misc.c
--- src/usr.sbin/mtree.orig/misc.c Tue Jun 27 21:33:17 2000
+++ src/usr.sbin/mtree/misc.c Fri Mar 29 08:42:56 2002
@@ -65,6 +65,7 @@
{"gid", F_GID, NEEDVALUE},
{"gname", F_GNAME, NEEDVALUE},
{"ignore", F_IGN, 0},
+ {"inum", F_INUM, NEEDVALUE},
{"link", F_SLINK, NEEDVALUE},
#ifdef MD5
{"md5digest", F_MD5, NEEDVALUE},
diff -u src/usr.sbin/mtree.orig/mtree.8 src/usr.sbin/mtree/mtree.8
--- src/usr.sbin/mtree.orig/mtree.8 Thu Aug 16 10:56:08 2001
+++ src/usr.sbin/mtree/mtree.8 Fri Mar 29 10:38:42 2002
@@ -226,6 +226,8 @@
.It Cm socket
socket
.El
+.It Cm inum
+The inode number of the file.
.El
.Pp
The default set of keywords are
diff -u src/usr.sbin/mtree.orig/mtree.h src/usr.sbin/mtree/mtree.h
--- src/usr.sbin/mtree.orig/mtree.h Thu Dec 9 14:38:35 1999
+++ src/usr.sbin/mtree/mtree.h Mon Apr 1 16:07:21 2002
@@ -58,6 +58,7 @@
mode_t st_mode; /* mode */
u_long st_flags; /* flags */
nlink_t st_nlink; /* link count */
+ ino_t st_ino; /* inode number */
=20
#define F_CKSUM 0x0001 /* check sum */
#define F_DONE 0x0002 /* directory done */
@@ -81,6 +82,7 @@
#define F_RMD160 0x40000 /* RIPEMD160 digest */
#define F_FLAGS 0x80000 /* file flags */
u_int flags; /* items set */
+#define F_INUM 0x100000 /* inode number */
=20
#define F_BLOCK 0x001 /* block special */
#define F_CHAR 0x002 /* char special */
diff -u src/usr.sbin/mtree.orig/spec.c src/usr.sbin/mtree/spec.c
--- src/usr.sbin/mtree.orig/spec.c Tue Jun 27 21:33:17 2000
+++ src/usr.sbin/mtree/spec.c Fri Mar 29 08:34:27 2002
@@ -307,6 +307,12 @@
errx(1, "line %d: unknown user %s", lineno, val);
ip->st_uid =3D pw->pw_uid;
break;
+ case F_INUM:
+ ip->st_ino =3D strtoul(val, &ep, 10);
+ if (*ep)
+ errx(1, "line %d: invalid inode number %s",
+ lineno, val);
+ break;
}
}
}
--SO98HVl1bnMOfKZd
Content-Type: text/plain; charset=us-ascii
Content-Disposition: attachment; filename="mtree.excerpt.txt"
Content-Transfer-Encoding: quoted-printable
[ryanb@m1 ~] $ date
Fri Mar 29 16:54:37 CST 2002
[ryanb@m1 ~] $ mtree -c -x -p . -k flags,uid,gid,nlink,mode,sha1digest,size=
,link,time,type,inum > /tmp/myhome.mtree=20
[ryanb@m1 ~] $ ls -i mtree.inode.patch=20
8076 mtree.inode.patch
[ryanb@m1 ~] $ cp -p mtree.inode.patch mtree.inode.patch.blargh
[ryanb@m1 ~] $ ls -i mtree.inode.patch*
8076 mtree.inode.patch 8078 mtree.inode.patch.blargh
[ryanb@m1 ~] $ rm mtree.inode.patch
[ryanb@m1 ~] $ mv mtree.inode.patch.blargh mtree.inode.patch =20
[ryanb@m1 ~] $ ls -i mtree.inode.patch=20
8078 mtree.inode.patch
[ryanb@m1 ~] $ mtree -x -p . -k flags,uid,gid,nlink,mode,sha1digest,size,li=
nk,time,type,inum < /tmp/myhome.mtree
=2E changed
modification time expected Fri Mar 29 16:48:04 2002 found Fri Mar 2=
9 16:57:04 2002
mtree.inode.patch changed
inode expected 8076 found 8078
--SO98HVl1bnMOfKZd--
--BZaMRJmqxGScZ8Mx
Content-Type: application/pgp-signature
Content-Disposition: inline
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.0.6 (FreeBSD)
Comment: For info see http://www.gnupg.org
iD8DBQE8qhdGCbo22TYyHRMRAs1KAJ0deEjnybwopjP4jfd/3+oAnBKG4wCaAjWM
XD0g6GNHm0cobiygZJjdPJk=
=3l7n
-----END PGP SIGNATURE-----
--BZaMRJmqxGScZ8Mx--
To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-audit" in the body of the message
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20020402204039.GE34680>