Date: Thu, 1 Jun 2000 17:30:10 +0100 (BST) From: dwmalone@maths.tcd.ie To: FreeBSD-gnats-submit@freebsd.org Subject: misc/18947: daily security script should list inode numbers? Message-ID: <200006011730.aa96531@walton.maths.tcd.ie>
next in thread | raw e-mail | index | archive | help
>Number: 18947
>Category: misc
>Synopsis: daily security script should list inode numbers?
>Confidential: no
>Severity: non-critical
>Priority: low
>Responsible: freebsd-bugs
>State: open
>Quarter:
>Keywords:
>Date-Required:
>Class: change-request
>Submitter-Id: current-users
>Arrival-Date: Thu Jun 01 09:40:00 PDT 2000
>Closed-Date:
>Last-Modified:
>Originator: David Malone
>Release: FreeBSD 3.4-STABLE i386
>Organization:
School of Mathematics, Trinity College, Dublin.
>Environment:
{3,4,5}.X
>Description:
The nightly security script remembers lots of stuff about all the
setuid files it finds, using "ls -lTd", remembering the inode number
of these files could be useful too. After all, if the inode number
has changed and nothing else you've either just restored from a
backup, or something strange is afoot!
>How-To-Repeat:
Have script kiddies use a badly written timestamp fixing program
on a suid program.
>Fix:
===================================================================
RCS file: security,v
retrieving revision 1.38
diff -u -r1.38 security
--- security 2000/04/06 10:46:50 1.38
+++ security 2000/06/01 16:16:14
@@ -35,7 +35,7 @@
find $mount -xdev -type f \
\( -perm -u+x -or -perm -g+x -or -perm -o+x \) \
\( -perm -u+s -or -perm -g+s \) -print0
-done | xargs -0 -n 20 ls -lTd | sort +9 > ${TMP}
+done | xargs -0 -n 20 ls -liTd | sort +10 > ${TMP}
if [ ! -f ${LOG}/setuid.today ]; then
separator
>Release-Note:
>Audit-Trail:
>Unformatted:
To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-bugs" in the body of the message
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?200006011730.aa96531>