From owner-freebsd-stable Mon Nov 5 3: 5:33 2001 Delivered-To: freebsd-stable@freebsd.org Received: from cyclone.tornadogroup.com (cyclone.tornadogroup.com [212.172.155.83]) by hub.freebsd.org (Postfix) with ESMTP id 2FF1F37B405; Mon, 5 Nov 2001 03:05:24 -0800 (PST) Received: from claudette.e1.tornadogroup.com (root@claudette.e1.tornadogroup.com [192.168.0.77]) by cyclone.tornadogroup.com (8.10.0.Beta10/8.10.0.Beta10) with ESMTP id fA5B5FE14460; Mon, 5 Nov 2001 11:05:15 GMT Received: from tornadogroup.com (matthew@localhost [127.0.0.1]) by claudette.e1.tornadogroup.com (8.11.6/8.11.6) with ESMTP id fA5B6Pf09740; Mon, 5 Nov 2001 11:06:26 GMT (envelope-from matthew.seaman@tornadogroup.com) Message-ID: <3BE672B1.2030601@tornadogroup.com> Date: Mon, 05 Nov 2001 11:06:25 +0000 From: Matthew Seaman User-Agent: Mozilla/5.0 (X11; U; FreeBSD i386; en-US; rv:0.9.5) Gecko/20011031 X-Accept-Language: en-GB, en MIME-Version: 1.0 To: Warner Losh Cc: "Hartmann, O." , AMAKAWA Shuhei , freebsd-stable@FreeBSD.ORG, freebsd-questions@FreeBSD.ORG Subject: Re: NIS/YP problems using pw(8) References: <3BD94295.24C7A9C@tornadogroup.com> <20011025205259.W1888-100000@klima.physik.uni-mainz.de> <200111030314.fA33Ei794774@harmony.village.org> Content-Type: text/plain; charset=us-ascii; format=flowed Content-Transfer-Encoding: 7bit Sender: owner-freebsd-stable@FreeBSD.ORG Precedence: bulk List-ID: List-Archive: (Web Archive) List-Help: (List Instructions) List-Subscribe: List-Unsubscribe: X-Loop: FreeBSD.ORG Warner Losh wrote: > In message <3BD94295.24C7A9C@tornadogroup.com> Matthew Seaman writes: > : +static int > : +issecure(const char *etcpath) > : +{ > : + struct stat stat_buf; > : + int ret; > : + int rc = 0; > : + > : + ret = lstat(etcpath, &stat_buf); > : + if (ret == 0 && \ > : + stat_buf.st_uid == 0 && \ > : + S_ISDIR(stat_buf.st_mode) && \ > : + (stat_buf.st_mode & (S_IWGRP|S_IWOTH)) == 0) { > : + rc = 1; > : + } > : + return rc; > : } > > First, you don't need \ at the end of the line. Ooops. I knew that, really. Too much time doing shell/perl recently. > Second, this is racible. Hmmm... Yes, so it is. I should have opened the file first and used fstat(2) on the descriptor. However, I didn't intend that what I wrote was any more than a suggestion about what might be done, not that it was suitable to go into CVS. On the wider issue, I agree entirely with Oliver's point, that pw(8) should be made to work effectively with the recommended setup of NIS. The more I think about it, the less I understand the reasoning behind disabling the functions that allow creation or deletion of home directories just because the NIS data files are in an alternate location. It's not like an attacker couldn't thoroughly compromise a system with the bits of pw(8) tht are still left active. Matthew -- Matthew Seaman 01628 498661 Abeo, abeo, abeo, actum est, comites! To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-stable" in the body of the message