From owner-freebsd-security Wed Oct 4 17:14: 1 2000 Delivered-To: freebsd-security@freebsd.org Received: from static.unixfreak.org (static.unixfreak.org [63.198.170.139]) by hub.freebsd.org (Postfix) with ESMTP id B7E8F37B503; Wed, 4 Oct 2000 17:13:59 -0700 (PDT) Received: by static.unixfreak.org (Postfix, from userid 1000) id 835C11F0A; Wed, 4 Oct 2000 17:13:59 -0700 (PDT) Subject: Re: BSD chpass (fwd) In-Reply-To: <20001004121701.C73561@freefall.freebsd.org> from Kris Kennaway at "Oct 4, 2000 12:17:01 pm" To: Kris Kennaway Date: Wed, 4 Oct 2000 17:13:59 -0700 (PDT) Cc: Garrett Wollman , Kris Kennaway , Dima Dorfman , Alfred Perlstein , Mike Silbersack , security@FreeBSD.ORG From: Dima Dorfman Reply-To: dima@unixfreak.org X-Mailer: ELM [version 2.4ME+ PL61 (25)] MIME-Version: 1.0 Content-Type: text/plain; charset=US-ASCII Content-Transfer-Encoding: 7bit Message-Id: <20001005001359.835C11F0A@static.unixfreak.org> Sender: owner-freebsd-security@FreeBSD.ORG Precedence: bulk X-Loop: FreeBSD.org > On Wed, Oct 04, 2000 at 10:47:15AM -0400, Garrett Wollman wrote: > > < said: > > > > > I think you're right. Which is a good reason why your /usr/bin should > > > be schg too ;-) > > > > Actually, sappnd on all the directories which might be in (or on the > > way to) root's path would be enough. > > Except you can still just mount a doctored copy over the top of it > :-) Actually, now that I think about it, this can be detered to a certain point. If you're running with securelevel >= 2, you can't load KLDs, and you can't run newfs. What would you mount? A vn device? Nope, unless the KLD is already loaded. A floppy? If you have physical access, you have better alternatives. You'd probably have to unmount another live filesystem and mount it in that place. Depending on what it is, you may have to erase some files on it, which isn't something which would go unnoticed by the admin. Then you have MFS and md, but those may not be in the kernel (and again, no KLDs). Maybe NFS. What else? -- Dima Dorfman Finger dima@unixfreak.org for my public PGP key. "Don't talk about yourself, it will be done when you leave." -- Wilson Mizner To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-security" in the body of the message