Date: Sun, 2 Feb 2020 22:42:37 +0200 From: Tommi Pernila <tommi.pernila@gmail.com> To: "Rodney W. Grimes" <freebsd-rwg@gndrsh.dnsmgr.net> Cc: Ben Woods <woodsb02@gmail.com>, FreeBSD Hackers <freebsd-hackers@freebsd.org>, Gordon Bergling <gbergling@googlemail.com>, Miroslav Lachman <000.fbsd@quip.cz>, Ryan Stone <rysto32@gmail.com>, Wojciech Puchar <wojtek@puchar.net> Subject: Re: More secure permissions for /root and /etc/sysctl.conf Message-ID: <CABHD1wTK1TUhEjL5-J_j3GAFoMevHRnt4UrKTN4zoxgGOCOmjg@mail.gmail.com> In-Reply-To: <202002021808.012I8CNm083835@gndrsh.dnsmgr.net> References: <616e8222-a377-fdf0-bf55-79e73a509065@quip.cz> <202002021808.012I8CNm083835@gndrsh.dnsmgr.net>
next in thread | previous in thread | raw e-mail | index | archive | help
On Sun 2. Feb 2020 at 20.08, Rodney W. Grimes <freebsd-rwg@gndrsh.dnsmgr.net> wrote: > [ Charset UTF-8 unsupported, converting... ] > > Ben Woods wrote on 2020/02/02 02:46: > > > > [...] > > > DragonFlyBSD 5.6.2 = 700 > > > HardenedBSD build 104 = 755 > > > NetBSD 9.0 RC1 = 755 > > > OpenBSD 6.6 = 700 > > > > > > For what it's worth, I am broadly supportive of this because I see no > > > reason for /root to be world readable. > > > > +1 > > > > I see no reason for world readable /root too. > > We always set user's homes to 0700 (subdirs of /usr/home). > > Who is "We" in this context? > > FreeBSD's default for home directories is 755. > > And as I have stated before anyone who is taking group rx off > of /root is fooling themselves as that just creates pain for > members of group wheel who now needlessly need to su to > see /root's files. > > If you have issues with group wheel being able to read /root > you have far far bigger problems that need addressed than > a simple chmod g-rw /root is going to fix. > 700 for /root has it's place but i think it is a POLA violation. I'm guessing that the majority here can agree that 755 is bit too broad? 750 should not create any problems and would be a good compromise. -T > -- > Rod Grimes > rgrimes@freebsd.org > _______________________________________________ > freebsd-hackers@freebsd.org mailing list > https://lists.freebsd.org/mailman/listinfo/freebsd-hackers > To unsubscribe, send any mail to "freebsd-hackers-unsubscribe@freebsd.org" >
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?CABHD1wTK1TUhEjL5-J_j3GAFoMevHRnt4UrKTN4zoxgGOCOmjg>