From owner-freebsd-security Sun Nov 3 15:32:44 1996 Return-Path: owner-security Received: (from root@localhost) by freefall.freebsd.org (8.7.5/8.7.3) id PAA11868 for security-outgoing; Sun, 3 Nov 1996 15:32:44 -0800 (PST) Received: from s4.elec.uq.edu.au (clary@s4.elec.uq.edu.au [130.102.96.4]) by freefall.freebsd.org (8.7.5/8.7.3) with ESMTP id PAA11857 for ; Sun, 3 Nov 1996 15:32:33 -0800 (PST) Received: (from clary@localhost) by s4.elec.uq.edu.au (8.7.5/8.6.12) id JAA07164; Mon, 4 Nov 1996 09:31:04 +1000 (EST) From: Clary Harridge Message-Id: <199611032331.JAA07164@s4.elec.uq.edu.au> Subject: Re: /etc/security To: karpen@ocean.campus.luth.se (Mikael Karpberg) Date: Mon, 4 Nov 1996 09:31:03 +1000 (EST) Cc: freebsd-security@FreeBSD.org In-Reply-To: <199611011141.MAA08439@ocean.campus.luth.se> from "Mikael Karpberg" at Nov 1, 96 12:41:41 pm X-Mailer: ELM [version 2.4 PL25] Content-Type: text Sender: owner-security@FreeBSD.org X-Loop: FreeBSD.org Precedence: bulk > ---- > > According to Garrett Wollman: > > < [... on the find job not handling ' characters either ...] > > >> checking setuid files and devices: > > >> find: /doscopy/sb16/pro_org/i'vebeen.org: illegal path > > >> find: /doscopy/sb16/pro_org/she'llbe.org: illegal path > > > > The best way to deal with this is probably using the `-print0' primary > > to `find' and using a `perl -n0' script to process the results, like: > > > > find ..... -print0 | perl -n0e 'exec "/bin/ls", "-lFgod", <>;' > > Would this solve the spaces problem too, and any other eventualities? > It may do but I don't think it is necessary. The problem is the -X switch of find, why use xargs anyway. The task of the find is to just ls any suid/sgid files. Why complicate it? from the find manual page -X The -X option is a modification to permit find to be safely used in conjunction with xargs(1). If a file name contains any of the delimiting characters used by xargs, a diagnostic message is displayed on standard error, and the file is skipped. The delim- iting characters include single (`` ' '') and double (`` " '') quotes, backslash (``\''), space, tab and newline characters. I read this to say that any suid file with a blank, or other delimiter, in the name will create an error but be skipped from the output. For example s5:/tmp # touch "Name with space" s5:/tmp # chmod 4777 !$ chmod 4777 "Name with space" s5:/tmp # ll !$ ll "Name with space" 0 -rwsrwxrwx 1 root bin 0 Nov 1 09:00 Name with space s5:/tmp # find -X . -xdev -type f \ \( -perm -u+x -or -perm -g+x -or -perm -o+x \) \ \( -perm -u+s -or -perm -g+s \) ? \( -perm -u+x -or -perm -g+x -or -perm -o+x \) \ ? \( -perm -u+s -or -perm -g+s \) find: ./Name with space: illegal path s5:/tmp # s5:/tmp # find . -xdev -type f \ \( -perm -u+x -or -perm -g+x -or -perm -o+x \) \ \( -perm -u+s -or -perm -g+s \) -a -exec ls -lgTd {} ";" ? \( -perm -u+x -or -perm -g+x -or -perm -o+x \) \ ? \( -perm -u+s -or -perm -g+s \) -a -exec ls -lgTd {} ";" -rwsrwxrwx 1 root bin 0 Nov 1 09:00:04 1996 ./Name with space So let's keep it simple. -- regards Dept. of Electrical Engineering, Clary Harridge University of Queensland, QLD, Australia, 4072 Phone: +61-7-3365-3636 Fax: +61-7-3365-4999 INTERNET: clary@elec.uq.edu.au