From owner-freebsd-bugs@FreeBSD.ORG Mon Jun 1 17:20:04 2009 Return-Path: Delivered-To: freebsd-bugs@hub.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34]) by hub.freebsd.org (Postfix) with ESMTP id AEE591065673 for ; Mon, 1 Jun 2009 17:20:04 +0000 (UTC) (envelope-from gnats@FreeBSD.org) Received: from freefall.freebsd.org (freefall.freebsd.org [IPv6:2001:4f8:fff6::28]) by mx1.freebsd.org (Postfix) with ESMTP id 89A008FC2E for ; Mon, 1 Jun 2009 17:20:04 +0000 (UTC) (envelope-from gnats@FreeBSD.org) Received: from freefall.freebsd.org (gnats@localhost [127.0.0.1]) by freefall.freebsd.org (8.14.3/8.14.3) with ESMTP id n51HK4cB008752 for ; Mon, 1 Jun 2009 17:20:04 GMT (envelope-from gnats@freefall.freebsd.org) Received: (from gnats@localhost) by freefall.freebsd.org (8.14.3/8.14.3/Submit) id n51HK4MD008750; Mon, 1 Jun 2009 17:20:04 GMT (envelope-from gnats) Resent-Date: Mon, 1 Jun 2009 17:20:04 GMT Resent-Message-Id: <200906011720.n51HK4MD008750@freefall.freebsd.org> Resent-From: FreeBSD-gnats-submit@FreeBSD.org (GNATS Filer) Resent-To: freebsd-bugs@FreeBSD.org Resent-Reply-To: FreeBSD-gnats-submit@FreeBSD.org, Roberto Grassi Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34]) by hub.freebsd.org (Postfix) with ESMTP id 76A5810656FC for ; Mon, 1 Jun 2009 17:13:34 +0000 (UTC) (envelope-from nobody@FreeBSD.org) Received: from www.freebsd.org (www.freebsd.org [IPv6:2001:4f8:fff6::21]) by mx1.freebsd.org (Postfix) with ESMTP id 6433A8FC1F for ; Mon, 1 Jun 2009 17:13:34 +0000 (UTC) (envelope-from nobody@FreeBSD.org) Received: from www.freebsd.org (localhost [127.0.0.1]) by www.freebsd.org (8.14.3/8.14.3) with ESMTP id n51HDYOH025269 for ; Mon, 1 Jun 2009 17:13:34 GMT (envelope-from nobody@www.freebsd.org) Received: (from nobody@localhost) by www.freebsd.org (8.14.3/8.14.3/Submit) id n51HDYow025268; Mon, 1 Jun 2009 17:13:34 GMT (envelope-from nobody) Message-Id: <200906011713.n51HDYow025268@www.freebsd.org> Date: Mon, 1 Jun 2009 17:13:34 GMT From: Roberto Grassi To: freebsd-gnats-submit@FreeBSD.org X-Send-Pr-Version: www-3.1 Cc: Subject: conf/135160: 100.chksetuid and non local filesystem mounted on subdirs X-BeenThere: freebsd-bugs@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Bug reports List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 01 Jun 2009 17:20:06 -0000 >Number: 135160 >Category: conf >Synopsis: 100.chksetuid and non local filesystem mounted on subdirs >Confidential: no >Severity: non-critical >Priority: low >Responsible: freebsd-bugs >State: open >Quarter: >Keywords: >Date-Required: >Class: change-request >Submitter-Id: current-users >Arrival-Date: Mon Jun 01 17:20:04 UTC 2009 >Closed-Date: >Last-Modified: >Originator: Roberto Grassi >Release: 7.2-STABLE >Organization: >Environment: FreeBSD nessus.obicon.local 7.2-STABLE FreeBSD 7.2-STABLE #0: Wed May 27 10:26:48 CEST 2009 root@ux-builder:/usr/obj/usr/src/sys/vmware-esx35 i386 >Description: The find options in the 100.chksetuid script will traverse mount points found as local (ufs or zfs) but the test if they are local is done on the mount point itself, no further checks are done for non local file system file below them. In the case a mount point is a subdir of a local mount point, the find will traverse it, causing the traverse go to other machine. Example: with this mount command output : /dev/da0d on /usr 10.10.10.10:/usr/ports on /usr/ports 10.10.10.11:/usr/src on /usr/src the command inside 100.chksetuid find -sx $MP /dev/null -type f \ \( -perm -u+x -or -perm -g+x -or -perm -o+x \) \ ... will go on 10.10.10.10 and 10.10.10.11 server. Moreover, in the case the NFS, SMBFS or other non local FS server did not respond all the periodic checks will not finish. >How-To-Repeat: use mountpoints for non local FS in subdirectory of /. >Fix: --- 100.chksetuid.orig 2008-12-27 19:07:31.000000000 +0100 +++ 100.chksetuid 2009-06-01 19:01:51.000000000 +0200 @@ -46,4 +46,5 @@ MP=`mount -t ufs,zfs | awk '$0 !~ /no(suid|exec)/ { print $3 }'` find -sx $MP /dev/null -type f \ + \( -fstype ufs -or -ftype zfs \) \ \( -perm -u+x -or -perm -g+x -or -perm -o+x \) \ \( -perm -u+s -or -perm -g+s \) -exec ls -liTd \{\} \+ | >Release-Note: >Audit-Trail: >Unformatted: