Date: Fri, 29 Mar 2002 14:05:44 -0500 From: Pierre-Luc =?iso-8859-1?Q?Lesp=E9rance?= <oksala@videotron.ca> To: Jason Stone <jason-fbsd-security@shalott.net> Cc: security@FreeBSD.ORG Subject: Re: make world and setuid bits Message-ID: <3CA4BB08.CB9E9275@videotron.ca> References: <20020328043119.V5333-100000@walter>
next in thread | previous in thread | raw e-mail | index | archive | help
Jason Stone wrote: > > -----BEGIN PGP SIGNED MESSAGE----- > Hash: SHA1 > > Are there make variables that can be set to prevent "make world" from > installing binaries as setuid? Currently, I always run something like > "find -perms -4000 | xargs chmod u-s" after doing a make world, but this > seems inelegant, prone to human error, and dangerous as there's a > (potentially quite long) period in which there are still many setuid > binaries.... > > make options to allow the prevention of "setuid root", "all setuid", > or "all setuid and all setgid" would be nice. > > -Jason You can mount your filesystem whith the "nosuid" option. I think it's exactly what your are looking for. I'm using it in a jailed environment but i've never did it on my / fs. see by yourself: man mount. hope it helps To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-security" in the body of the message
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?3CA4BB08.CB9E9275>