From owner-freebsd-questions Tue Jul 2 17:33:16 1996 Return-Path: owner-questions Received: (from root@localhost) by freefall.freebsd.org (8.7.5/8.7.3) id RAA15057 for questions-outgoing; Tue, 2 Jul 1996 17:33:16 -0700 (PDT) Received: from relay-2.mail.demon.net (disperse.demon.co.uk [158.152.1.77]) by freefall.freebsd.org (8.7.5/8.7.3) with SMTP id RAA15051 for ; Tue, 2 Jul 1996 17:33:13 -0700 (PDT) Received: from post.demon.co.uk ([158.152.1.72]) by relay-2.mail.demon.net id ab29622; 3 Jul 96 1:33 +0100 Received: from jraynard.demon.co.uk ([158.152.42.77]) by relay-3.mail.demon.net id aa28475; 3 Jul 96 0:12 +0100 Received: (from fqueries@localhost) by jraynard.demon.co.uk (8.6.12/8.6.12) id UAA00658; Tue, 2 Jul 1996 20:08:03 GMT Date: Tue, 2 Jul 1996 20:08:03 GMT Message-Id: <199607022008.UAA00658@jraynard.demon.co.uk> From: James Raynard To: jimd@mistery.mcafee.com CC: tcg@ime.net, dwhite@resnet.uoregon.edu, questions@freebsd.org In-reply-to: <201007021826.LAA23381@mistery.mcafee.com> (message from Jim Dennis on Fri, 2 Jul 110 11:26:09 -0700 (PDT)) Subject: Re: src tree owners Sender: owner-questions@freebsd.org X-Loop: FreeBSD.org Precedence: bulk > > > On Unix, the `proper` way is for configuration files to be owned by > > > root - it's not a good idea to allow just anybody to change them! > > > > I Agree! My question was/is about the Source tree! I originally wrote "critical files such as source code or configuration files", then changed my mind and deleted the wrong bit. Sorry about that :-( > You might consider simply adding yourself to the 'bin' group Yep, just edit /etc/group. > (and setting the SGID bit on the directories). The default Actually, there's no need to set the SGID bit on the directories, as BSD systems automatically pass the group ownership on to any new sub-directories created in the current directory - see mkdir(2). > configuration seems to leave the sources g+w and owned by > root.bin. Something that just occurred to me - doesn't some network backup software require a .rhosts file for the user "bin"? If so, doesn't this leave the system source code potentially vulnerable? > In a multi-user environment you should consider installing > tripwire and being particularly careful to monitor it for > source tree changes. Anyone who can get a simply change into > any source file -- and get 'root' to build it can effectively > take control of the entire system. (This is true of the system > binaries as well -- but more insidious). Very true. -- James Raynard, Edinburgh, Scotland james@jraynard.demon.co.uk http://www.freebsd.org/~jraynard/