Date: Tue, 19 Dec 2000 19:32:59 -0600 From: lists+freebsd-security@niss.com To: Garrett Wollman <wollman@khavrinen.lcs.mit.edu> Cc: Guy Helmer <ghelmer@palisadesys.com>, freebsd-security@FreeBSD.ORG Subject: Re: Securing FreeBSD against hacking Message-ID: <200012200132.TAA83848@crag.niss.com>
next in thread | raw e-mail | index | archive | help
I used to post-process the mtree specification and remove
all time=value settings for directories. However, for items
such as /dev/tty, that's not enough. In that case, the mode
and other attributes change as well.
A few days ago I modified mtree to accept the syntax of
"keyword=*". The star indicates that the value for that
keyword should be cleared, even if it was set using the
"/set keyword=default" directive.
I still post-process the output to allow for known changes,
but this feature makes it a much simpler task.
The patch to mtree from 4.2 is included below.
Scott
P.S. If someone with commit privileges could add this
I would appreciate it.
On Tue, 19 Dec 2000 15:19:48 -0500 (EST), Garrett Wollman wrote:
>
> You'd probably find that to be rather difficult and tedious, and
> there's no reason to do such a comparison by hand since that function
> is built in to mtree. Just do `mtree -d /mnt/foo -f /rdonly/foo.mtree'.
>
> After setting up a new system for the first time, I recommend doing a:
>
> mtree -c -i -x -p /file/system -k \
> size,flags,gid,md5digest,sha1digest,ripemd160digest,mode,nlink,uid,link,time
>
> for every filesystem. You might well want to use an excludes file
> for directories containing files which are very likely to change. For
> example, a quick test showed me:
>
> .: modification time (Tue Dec 19 15:10:20 2000, Tue Dec 19 15:11:34 2000)
> dev/ttyp1:
> modification time (Tue Dec 19 15:10:25 2000, Tue Dec 19 15:15:26 2000)
> dev/ptyp1:
> modification time (Tue Dec 19 15:10:25 2000, Tue Dec 19 15:15:26 2000)
> dev/ttyp2:
> modification time (Tue Dec 19 15:10:25 2000, Tue Dec 19 15:15:26 2000)
> dev/null:
> modification time (Tue Dec 19 15:05:54 2000, Tue Dec 19 15:11:03 2000)
> tmp: modification time (Tue Dec 19 15:10:01 2000, Tue Dec 19 15:15:23 2000)
diff -ru mtree-4.2/mtree.8 mtree-4.2+/mtree.8
--- mtree-4.2/mtree.8 Fri Jun 30 04:54:06 2000
+++ mtree-4.2+/mtree.8 Sat Dec 16 19:08:18 2000
@@ -136,7 +136,8 @@
Specifications are mostly composed of ``keywords'', i.e. strings that
that specify values relating to files.
No keywords have default values, and if a keyword has no value set, no
-checks based on it are performed.
+checks based on it are performed. If the value is ``*'', then any default
+value for that keyword is cleared.
.Pp
Currently supported keywords are as follows:
.Bl -tag -width Cm
diff -ru mtree-4.2/spec.c mtree-4.2+/spec.c
--- mtree-4.2/spec.c Tue Jun 27 21:33:17 2000
+++ mtree-4.2+/spec.c Sat Dec 16 19:08:12 2000
@@ -186,6 +186,10 @@
ip->flags |= type = parsekey(kw, &value);
if (value && (val = strtok(NULL, " \t\n")) == NULL)
errx(1, "line %d: missing value", lineno);
+ if (strcmp("*", val) == 0) {
+ ip->flags &= ~type;
+ continue;
+ }
switch(type) {
case F_CKSUM:
ip->cksum = strtoul(val, &ep, 10);
To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-security" in the body of the message
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?200012200132.TAA83848>