Date: Mon, 23 Dec 1996 23:01:35 -0700 (MST) From: Marc Slemko <marcs@znep.com> To: Steve Reid <steve@edmweb.com> Cc: freebsd-security@freebsd.org Subject: Re: Holes in default cron jobs (fwd) Message-ID: <Pine.BSF.3.95.961223224443.19477F-100000@alive.ampr.ab.ca> In-Reply-To: <Pine.BSF.3.95.961223201110.2670A-100000@bitbucket.edmweb.com>
next in thread | previous in thread | raw e-mail | index | archive | help
NOTE: anyone running a -stable system should apply something resembling the patch included below. While some kind soul (hint, hint) may commit the below change to -stable, it won't have too much effect since few people reinstall /etc. Anyone running -current should check to be sure their /etc/security is an updated one. On Mon, 23 Dec 1996, Steve Reid wrote: > The only problem they mention in FreeBSD is in /etc/security. Rather than > use the OpenBSD /etc/security, I've copied the tmp file change into > FreeBSD's /etc/security. It is generally better to append a context diff (diff -u; or my preffered format, -c) instead of the file; regardless of how short it is, it makes it easier to see what has changed. > > I'm running 2.1.6.1-RELEASE, but the machine was originally a > 2.1.0-RELEASE... Has the /etc/security been updated since then? There have been some changes that have not made it to -stable, notably: pst 96/07/30 23:47:06 Modified: etc security Log: Move intermediary file generation to /var partition Revision Changes Path 1.14 +2 -2 src/etc/security This change simply does: ----snip---- --- security 1996/06/30 19:35:20 1.13 +++ security 1996/07/31 06:47:05 1.14 @@ -15,7 +15,7 @@ echo "Subject: $host security check output" LOG=/var/log -TMP=/tmp/_secure.$$ +TMP=/var/run/_secure.$$ umask 027 ----snip---- which secures it by using /var/run, which shouldn't be world writable. > Here's my modified /etc/security. Let me know what you think. > > > #!/bin/sh - > # > # @(#)security 5.3 (Berkeley) 5/28/91 > # $Id: security,v 1.8 1995/05/27 01:37:44 ache Exp $ > # > PATH=/sbin:/bin:/usr/bin > > host=`hostname -s` > echo "Subject: $host security check output" > > LOG=/var/log > TDIR=/tmp/_secure.$$ > > umask 027 (general comment; not about your patch) I would prefer 077 instead of 027. It doesn't hurt right now, and nothing that confidential is written to $TDIR, but... some day... somep place... > > # Here's my modification, also rmdir later > if ! mkdir $TDIR ; then > echo $TDIR already exists > ls -alF $TDIR > exit 1 > fi > TMP=$TDIR/secure Why not do it as a trap that calls 'rm -rf $TDIR' like the bulletin suggests? Makes sure it gets deleted, even if some file exists in it or it exits early for some reason. Your patch does fix the problem, but isn't necessary in -current.
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?Pine.BSF.3.95.961223224443.19477F-100000>