Date: Tue, 24 Jul 2001 19:33:39 +0100 From: Ben Smithurst <ben@FreeBSD.org> To: Jon Loeliger <jdl@jdl.com>, security@freebsd.org Subject: Re: Security Check Diffs Question Message-ID: <20010724193339.H20105@strontium.shef.vinosystems.com> In-Reply-To: <20010724212444.A19217@ringworld.oblivion.bg> References: <200107241632.LAA05639@chrome.jdl.com> <20010724205228.A16243@ringworld.oblivion.bg> <20010724190607.F20105@strontium.shef.vinosystems.com> <20010724212444.A19217@ringworld.oblivion.bg>
next in thread | previous in thread | raw e-mail | index | archive | help
--gr/z0/N6AeWAPJVB
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable
Peter Pentchev wrote:
> 'Replacing' would not be enough - removing the file or moving something
> over it (the way install(1) does) would change its inode number.
I meant if they did something like
cat my_trojan > /usr/bin/su
or whatever, which wouldn't change the inode number...
But...
> The ctime, too, can be changed,
=2E.. Never mind then. :-( Maybe /etc/security should be updated to do
stuff with mtree's md5/sha1 digest stuff...
--=20
Ben Smithurst / ben@FreeBSD.org FreeBSD: The Power To Serve
http://www.FreeBSD.org/
--gr/z0/N6AeWAPJVB
Content-Type: application/pgp-signature
Content-Disposition: inline
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.0.6 (FreeBSD)
Comment: For info see http://www.gnupg.org
iD8DBQE7Xb+CbPzJ+yzvRCwRArAIAJwIuy80YiSSB96cNnM59MKSDFbIMQCfWbHB
N1N++Upsz+rsXHXEXsKReFU=
=bIV0
-----END PGP SIGNATURE-----
--gr/z0/N6AeWAPJVB--
To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-security" in the body of the message
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20010724193339.H20105>