From owner-freebsd-bugs  Sun Aug  4  5:20:12 2002
Delivered-To: freebsd-bugs@hub.freebsd.org
Received: from mx1.FreeBSD.org (mx1.FreeBSD.org [216.136.204.125])
	by hub.freebsd.org (Postfix) with ESMTP id CCC2237B401
	for <freebsd-bugs@hub.freebsd.org>; Sun,  4 Aug 2002 05:20:03 -0700 (PDT)
Received: from freefall.freebsd.org (freefall.FreeBSD.org [216.136.204.21])
	by mx1.FreeBSD.org (Postfix) with ESMTP id 07BEF43E65
	for <freebsd-bugs@hub.freebsd.org>; Sun,  4 Aug 2002 05:20:03 -0700 (PDT)
	(envelope-from gnats@FreeBSD.org)
Received: from freefall.freebsd.org (gnats@localhost [127.0.0.1])
	by freefall.freebsd.org (8.12.4/8.12.4) with ESMTP id g74CK2JU019198
	for <freebsd-bugs@freefall.freebsd.org>; Sun, 4 Aug 2002 05:20:02 -0700 (PDT)
	(envelope-from gnats@freefall.freebsd.org)
Received: (from gnats@localhost)
	by freefall.freebsd.org (8.12.4/8.12.4/Submit) id g74CK2IP019197;
	Sun, 4 Aug 2002 05:20:02 -0700 (PDT)
Received: from mx1.FreeBSD.org (mx1.FreeBSD.org [216.136.204.125])
	by hub.freebsd.org (Postfix) with ESMTP id ECD4C37B40B
	for <freebsd-gnats-submit@FreeBSD.org>; Sun,  4 Aug 2002 05:12:23 -0700 (PDT)
Received: from www.freebsd.org (www.FreeBSD.org [216.136.204.117])
	by mx1.FreeBSD.org (Postfix) with ESMTP id D42CF43E8A
	for <freebsd-gnats-submit@FreeBSD.org>; Sun,  4 Aug 2002 05:12:16 -0700 (PDT)
	(envelope-from nobody@FreeBSD.org)
Received: from www.freebsd.org (localhost [127.0.0.1])
	by www.freebsd.org (8.12.4/8.12.4) with ESMTP id g74CAtOT073404
	for <freebsd-gnats-submit@FreeBSD.org>; Sun, 4 Aug 2002 05:10:55 -0700 (PDT)
	(envelope-from nobody@www.freebsd.org)
Received: (from nobody@localhost)
	by www.freebsd.org (8.12.4/8.12.4/Submit) id g74CAha1073392;
	Sun, 4 Aug 2002 05:10:43 -0700 (PDT)
Message-Id: <200208041210.g74CAha1073392@www.freebsd.org>
Date: Sun, 4 Aug 2002 05:10:43 -0700 (PDT)
From: Oliver Eikemeier <eikemeier@fillmore-labs.de>
To: freebsd-gnats-submit@FreeBSD.org
X-Send-Pr-Version: www-1.0
Subject: misc/41309: security check scripts do not delete temporary files when disabled
Sender: owner-freebsd-bugs@FreeBSD.ORG
Precedence: bulk
List-ID: <freebsd-bugs.FreeBSD.ORG>
List-Archive: <http://docs.freebsd.org/mail/> (Web Archive)
List-Help: <mailto:majordomo@FreeBSD.ORG?subject=help> (List Instructions)
List-Subscribe: <mailto:majordomo@FreeBSD.ORG?subject=subscribe%20freebsd-bugs>
List-Unsubscribe: <mailto:majordomo@FreeBSD.ORG?subject=unsubscribe%20freebsd-bugs>
X-Loop: FreeBSD.org


>Number:         41309
>Category:       misc
>Synopsis:       security check scripts do not delete temporary files when disabled
>Confidential:   no
>Severity:       non-critical
>Priority:       medium
>Responsible:    freebsd-bugs
>State:          open
>Quarter:        
>Keywords:       
>Date-Required:
>Class:          sw-bug
>Submitter-Id:   current-users
>Arrival-Date:   Sun Aug 04 05:20:02 PDT 2002
>Closed-Date:
>Last-Modified:
>Originator:     Oliver Eikemeier
>Release:        4.6-STABLE
>Organization:
Fillmore Labs <http://www.fillmore-labs.com>
>Environment:
FreeBSD cvs.fillmore-labs.com 4.6-STABLE FreeBSD 4.6-STABLE #2: Sat Aug  3 13:28:06 CEST 2002     root@lima.fillmore-labs.com:/usr/obj/usr/src/sys/LIMA  i386     
>Description:
The default security check scripts
 100.chksetuid
 200.chkmounts
 500.ipfwdenied
 550.ipfwlimit
 600.ip6fwdenied
 650.ip6fwlimit
 700.kernelmsg
(all in /etc/periodic/security)
create a temporary file with ' /tmp/security.XXXXXXXXXX', but delete them only when they are enabled. This is especially annoying in a jail, where you have to disable some.
>How-To-Repeat:
set
daily_status_security_chksetuid_enable="NO"
daily_status_security_chkmounts_enable="NO"
daily_status_security_noamd="NO"
daily_status_security_nomfs="NO"
daily_status_security_ipfwdenied_enable="NO"
daily_status_security_ipfwlimit_enable="NO"
daily_status_security_ip6fwdenied_enable="NO"
daily_status_security_ip6fwlimit_enable="NO"
daily_status_security_kernelmsg_enable="NO"
in /etc/periodic.conf, wait 24 hours...     
>Fix:
workaround: set daily_clean_tmps_enable="NO" in periodic.conf

fix: change the scripts that the files are only created when needed.
>Release-Note:
>Audit-Trail:
>Unformatted:

To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-bugs" in the body of the message