From owner-freebsd-security Sat Sep 8 19:21:57 2001 Delivered-To: freebsd-security@freebsd.org Received: from nagual.pp.ru (pobrecita.freebsd.ru [194.87.13.42]) by hub.freebsd.org (Postfix) with ESMTP id E944E37B403; Sat, 8 Sep 2001 19:21:48 -0700 (PDT) Received: (from ache@localhost) by nagual.pp.ru (8.11.6/8.11.6) id f892KQ935017; Sun, 9 Sep 2001 06:20:26 +0400 (MSD) (envelope-from ache) Date: Sun, 9 Sep 2001 06:20:25 +0400 From: "Andrey A. Chernov" To: Kris Kennaway Cc: "Todd C. Miller" , Matt Dillon , Jordan Hubbard , security@FreeBSD.ORG, audit@FreeBSD.ORG Subject: Re: Fwd: Multiple vendor 'Taylor UUCP' problems. Message-ID: <20010909062025.B34828@nagual.pp.ru> References: <20010908154617.A73143@xor.obsecurity.org> <20010908170257.A82082@xor.obsecurity.org> <20010908174304.A88816@xor.obsecurity.org> <20010909045226.A33654@nagual.pp.ru> <20010908180848.A94567@xor.obsecurity.org> <200109090120.f891KvM14677@xerxes.courtesan.com> <20010909054457.A34319@nagual.pp.ru> <20010908185602.B5619@xor.obsecurity.org> <20010909060144.B34519@nagual.pp.ru> <20010908191013.B5881@xor.obsecurity.org> Mime-Version: 1.0 Content-Type: multipart/signed; micalg=pgp-md5; protocol="application/pgp-signature"; boundary="61jdw2sOBCFtR2d/" Content-Disposition: inline In-Reply-To: <20010908191013.B5881@xor.obsecurity.org> User-Agent: Mutt/1.3.21i Sender: owner-freebsd-security@FreeBSD.ORG Precedence: bulk List-ID: List-Archive: (Web Archive) List-Help: (List Instructions) List-Subscribe: List-Unsubscribe: X-Loop: FreeBSD.org --61jdw2sOBCFtR2d/ Content-Type: text/plain; charset=us-ascii Content-Disposition: inline Content-Transfer-Encoding: quoted-printable On Sat, Sep 08, 2001 at 19:10:13 -0700, Kris Kennaway wrote: > Actually, I think I was overstating a bit. You can't set UFS file > flags on an NFS volume, but they should work fine if already set on > the server and /usr is mounted by a client. >=20 > What will break is trying to do an installworld onto a remote NFS > volume, or installworld within a jail, since in order for that to > succeed you have to tell it not to set file flags, and that will leave > you with a local root exploit on the installed system. This is different problem we already have in other places, since we install f.e. libc, sliplogin, login, chpass, etc. etc. with -fschg It means no remote NFS installation allowed. --=20 Andrey A. Chernov http://ache.pp.ru/ --61jdw2sOBCFtR2d/ Content-Type: application/pgp-signature Content-Disposition: inline -----BEGIN PGP SIGNATURE----- Version: 2.6.3ia iQCVAwUBO5rR6eJgpPLZnQjrAQFb3QQA0zpLYjrB6n8Qeqa2JDlNBG3E156a00Hr 1Y3h6xLDx7x+Aqho+IOg2ukLdNu8gyOBxOyoiqXTpSa9e8frMHGeh3WiCk7wZZRq EeFRjmVtAk4EN6zy9ohwtVYHjy/xrPkPoCL3j5ykpsXwpWY5jnB4brVDUoblsrYE 4ouE6wBiFmo= =qb5e -----END PGP SIGNATURE----- --61jdw2sOBCFtR2d/-- To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-security" in the body of the message