From owner-cvs-src@FreeBSD.ORG Sun Jul 3 01:01:33 2005 Return-Path: X-Original-To: cvs-src@FreeBSD.org Delivered-To: cvs-src@FreeBSD.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id 619AA16A630; Sun, 3 Jul 2005 00:57:17 +0000 (GMT) (envelope-from ps@mu.org) Received: from elvis.mu.org (elvis.mu.org [192.203.228.196]) by mx1.FreeBSD.org (Postfix) with ESMTP id B3E8D43F1C; Sun, 3 Jul 2005 00:37:39 +0000 (GMT) (envelope-from ps@mu.org) Received: by elvis.mu.org (Postfix, from userid 1000) id AA3576D7CB; Sat, 2 Jul 2005 17:37:17 -0700 (PDT) X-Original-To: ps@mu.org Delivered-To: ps@mu.org Received: from mx2.freebsd.org (mx2.freebsd.org [216.136.204.119]) by elvis.mu.org (Postfix) with ESMTP id 385A05C9E9 for ; Thu, 13 Jan 2005 11:34:25 -0800 (PST) Received: from hub.freebsd.org (hub.freebsd.org [216.136.204.18]) by mx2.freebsd.org (Postfix) with ESMTP id 0DC985550B for ; Thu, 13 Jan 2005 19:34:24 +0000 (GMT) (envelope-from owner-src-committers@FreeBSD.org) Received: by hub.freebsd.org (Postfix) id 50EE116A549; Thu, 13 Jan 2005 19:34:20 +0000 (GMT) Delivered-To: ps@freebsd.org Received: by hub.freebsd.org (Postfix, from userid 538) id A42D016A4D0; Thu, 13 Jan 2005 19:34:18 +0000 (GMT) Delivered-To: src-committers@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id A529116A4CF for ; Thu, 13 Jan 2005 19:34:17 +0000 (GMT) Received: from mail15.speakeasy.net (mail23.sea5.speakeasy.net [69.17.117.25]) by mx1.FreeBSD.org (Postfix) with ESMTP id EE53443D46 for ; Thu, 13 Jan 2005 19:34:16 +0000 (GMT) (envelope-from jmg@hydrogen.funkthat.com) Received: (qmail 1717 invoked from network); 13 Jan 2005 19:34:16 -0000 Received: from gate.funkthat.com (HELO hydrogen.funkthat.com) ([69.17.45.168]) (envelope-sender ) by mail15.speakeasy.net (qmail-ldap-1.03) with SMTP for ; 13 Jan 2005 19:34:16 -0000 Received: from hydrogen.funkthat.com (tuxoxq@localhost.funkthat.com [127.0.0.1]) by hydrogen.funkthat.com (8.12.10/8.11.6) with ESMTP id j0DJYFGH058557; Thu, 13 Jan 2005 11:34:15 -0800 (PST) (envelope-from jmg@hydrogen.funkthat.com) Received: (from jmg@localhost) by hydrogen.funkthat.com (8.12.10/8.12.10/Submit) id j0DJYDc6058556; Thu, 13 Jan 2005 11:34:13 -0800 (PST) From: John-Mark Gurney To: Giorgos Keramidas Message-ID: <20050113193413.GL19624@funkthat.com> References: <20050113153228.GG49329@submonkey.net> <200501131849.j0DInEEE029957@gw.catspoiler.org> <20050113185323.GI49329@submonkey.net> <20050113190755.GA24939@orion.daedalusnetworks.priv> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <20050113190755.GA24939@orion.daedalusnetworks.priv> User-Agent: Mutt/1.4.1i X-Operating-System: FreeBSD 4.2-RELEASE i386 X-PGP-Fingerprint: B7 EC EF F8 AE ED A7 31 96 7A 22 B3 D8 56 36 F4 X-Files: The truth is out there X-URL: http://resnet.uoregon.edu/~gurney_j/ X-Resume: http://resnet.uoregon.edu/~gurney_j/resume.html Sender: owner-src-committers@FreeBSD.org Precedence: bulk X-Loop: FreeBSD.ORG X-Spam-Checker-Version: SpamAssassin 3.0.1 (2004-10-22) on elvis.mu.org X-Spam-Status: No, score=-2.6 required=5.0 tests=BAYES_00 autolearn=ham version=3.0.1 X-Spam-Level: Cc: src-committers@FreeBSD.org, cvs-src@FreeBSD.org, Don Lewis , cvs-all@FreeBSD.org, glebius@FreeBSD.org, Ceri Davies Subject: Re: cvs commit: src/etc/periodic/security 100.chksetuid X-BeenThere: cvs-src@freebsd.org X-Mailman-Version: 2.1.5 Reply-To: John-Mark Gurney List-Id: CVS commit messages for the src tree List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Date: Sun, 03 Jul 2005 01:01:36 -0000 X-Original-Date: Thu, 13 Jan 2005 11:34:13 -0800 X-List-Received-Date: Sun, 03 Jul 2005 01:01:36 -0000 Giorgos Keramidas wrote this message on Thu, Jan 13, 2005 at 21:07 +0200: > > Sounds like something like chksetuid_exclude which lists mountpoints to > > exclude might be in order. Any objections to me putting that together, > > or are people happy with the status quo? > > It's not a bad idea. While you're at it, a knob that disables checks > for NFS-mounted filesystems may be nice too. It doesn't make sense to > check the same files both in the client *and* the server, as Don has > pointed out. > > I think I can almost see this coming :-) > > daily_status_security_chksetuid_nfs="NO" Why not do something like: daily_status_security_chksetuid_remote="NO" Find already has "logic" that tries to determin if an fs is local or remote.. -- John-Mark Gurney Voice: +1 415 225 5579 "All that I will do, has been done, All that I have, has not."