From owner-freebsd-bugs  Thu Jun  1  9:40:12 2000
Delivered-To: freebsd-bugs@freebsd.org
Received: from freefall.freebsd.org (freefall.FreeBSD.ORG [204.216.27.21])
	by hub.freebsd.org (Postfix) with ESMTP id 1438437BE70
	for <freebsd-bugs@FreeBSD.org>; Thu,  1 Jun 2000 09:40:01 -0700 (PDT)
	(envelope-from gnats@FreeBSD.org)
Received: (from gnats@localhost)
	by freefall.freebsd.org (8.9.3/8.9.2) id JAA03488;
	Thu, 1 Jun 2000 09:40:01 -0700 (PDT)
	(envelope-from gnats@FreeBSD.org)
Received: from salmon.maths.tcd.ie (salmon.maths.tcd.ie [134.226.81.11])
	by hub.freebsd.org (Postfix) with SMTP id 8FA0037B5ED
	for <FreeBSD-gnats-submit@freebsd.org>; Thu,  1 Jun 2000 09:30:12 -0700 (PDT)
	(envelope-from dwmalone@maths.tcd.ie)
Received: from walton.maths.tcd.ie by salmon.maths.tcd.ie with SMTP
          id <aa00589@salmon>; 1 Jun 2000 17:30:11 +0100 (BST)
Message-Id: <200006011730.aa96531@walton.maths.tcd.ie>
Date: Thu, 1 Jun 2000 17:30:10 +0100 (BST)
From: dwmalone@maths.tcd.ie
Reply-To: dwmalone@maths.tcd.ie
To: FreeBSD-gnats-submit@freebsd.org
X-Send-Pr-Version: 3.2
Subject: misc/18947: daily security script should list inode numbers?
Sender: owner-freebsd-bugs@FreeBSD.ORG
Precedence: bulk
X-Loop: FreeBSD.org


>Number:         18947
>Category:       misc
>Synopsis:       daily security script should list inode numbers?
>Confidential:   no
>Severity:       non-critical
>Priority:       low
>Responsible:    freebsd-bugs
>State:          open
>Quarter:        
>Keywords:       
>Date-Required:
>Class:          change-request
>Submitter-Id:   current-users
>Arrival-Date:   Thu Jun 01 09:40:00 PDT 2000
>Closed-Date:
>Last-Modified:
>Originator:     David Malone
>Release:        FreeBSD 3.4-STABLE i386
>Organization:
School of Mathematics, Trinity College, Dublin.
>Environment:

{3,4,5}.X

>Description:

The nightly security script remembers lots of stuff about all the
setuid files it finds, using "ls -lTd", remembering the inode number
of these files could be useful too. After all, if the inode number
has changed and nothing else you've either just restored from a
backup, or something strange is afoot!

>How-To-Repeat:

Have script kiddies use a badly written timestamp fixing program
on a suid program.

>Fix:

===================================================================
RCS file: security,v
retrieving revision 1.38
diff -u -r1.38 security
--- security	2000/04/06 10:46:50	1.38
+++ security	2000/06/01 16:16:14
@@ -35,7 +35,7 @@
 	find $mount -xdev -type f \
 		\( -perm -u+x -or -perm -g+x -or -perm -o+x \) \
 		\( -perm -u+s -or -perm -g+s \) -print0
-done | xargs -0 -n 20 ls -lTd | sort +9 > ${TMP}
+done | xargs -0 -n 20 ls -liTd | sort +10 > ${TMP}
 
 if [ ! -f ${LOG}/setuid.today ]; then
 	separator

>Release-Note:
>Audit-Trail:
>Unformatted:


To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-bugs" in the body of the message