From owner-freebsd-questions@FreeBSD.ORG Thu Jul 3 10:30:06 2014 Return-Path: Delivered-To: freebsd-questions@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [8.8.178.115]) (using TLSv1 with cipher ADH-AES256-SHA (256/256 bits)) (No client certificate requested) by hub.freebsd.org (Postfix) with ESMTPS id E1262FDB for ; Thu, 3 Jul 2014 10:30:05 +0000 (UTC) Received: from smtp.infracaninophile.co.uk (smtp6.infracaninophile.co.uk [IPv6:2001:8b0:151:1:3cd3:cd67:fafa:3d78]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (Client CN "smtp.infracaninophile.co.uk", Issuer "ca.infracaninophile.co.uk" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 8D9F82638 for ; Thu, 3 Jul 2014 10:30:05 +0000 (UTC) Received: from ox-dell39.ox.adestra.com (no-reverse-dns.metronet-uk.com [85.199.232.226] (may be forged)) (authenticated bits=0) by smtp.infracaninophile.co.uk (8.14.9/8.14.9) with ESMTP id s63ATnmh062275 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES128-SHA bits=128 verify=NO) for ; Thu, 3 Jul 2014 11:29:57 +0100 (BST) (envelope-from matthew@freebsd.org) Authentication-Results: lucid-nonsense.infracaninophile.co.uk; dmarc=none header.from=freebsd.org DKIM-Filter: OpenDKIM Filter v2.9.2 smtp.infracaninophile.co.uk s63ATnmh062275 Authentication-Results: smtp.infracaninophile.co.uk/s63ATnmh062275; dkim=none reason="no signature"; dkim-adsp=none; dkim-atps=neutral X-Authentication-Warning: lucid-nonsense.infracaninophile.co.uk: Host no-reverse-dns.metronet-uk.com [85.199.232.226] (may be forged) claimed to be ox-dell39.ox.adestra.com Message-ID: <53B53096.3070600@freebsd.org> Date: Thu, 03 Jul 2014 11:29:42 +0100 From: Matthew Seaman User-Agent: Mozilla/5.0 (X11; FreeBSD amd64; rv:24.0) Gecko/20100101 Thunderbird/24.6.0 MIME-Version: 1.0 To: freebsd-questions@freebsd.org Subject: Re: Security Warning References: <20140703055740.0f94e5e1@scorpio> In-Reply-To: <20140703055740.0f94e5e1@scorpio> X-Enigmail-Version: 1.6 Content-Type: multipart/signed; micalg=pgp-sha512; protocol="application/pgp-signature"; boundary="wETofr9M988tXjPfC0cpsSKHcqXgRfI7q" X-Virus-Scanned: clamav-milter 0.98.3 at lucid-nonsense.infracaninophile.co.uk X-Virus-Status: Clean X-Spam-Status: No, score=-0.9 required=5.0 tests=AWL,BAYES_00,RDNS_NONE, SPF_SOFTFAIL autolearn=no autolearn_force=no version=3.4.0 X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on lucid-nonsense.infracaninophile.co.uk X-BeenThere: freebsd-questions@freebsd.org X-Mailman-Version: 2.1.18 Precedence: list List-Id: User questions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 03 Jul 2014 10:30:06 -0000 This is an OpenPGP/MIME signed message (RFC 4880 and 3156) --wETofr9M988tXjPfC0cpsSKHcqXgRfI7q Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: quoted-printable On 07/03/14 10:57, Jerry wrote: > Thu, 3 Jul 2014 05:55:05 -0400 >=20 > FreeBSD-10 / amd64 >=20 > Every morning I receive a security email with the following notations: >=20 > Checking setuid files and devices: > find: /usr/share/groff_font/devX100/CI: Bad file descriptor > find: /usr/share/groff_font/devX100/S: Bad file descriptor >=20 > Checking negative group permissions: > find: /usr/share/groff_font/devX100/CI: Bad file descriptor > find: /usr/share/groff_font/devX100/S: Bad file descriptor >=20 > Is there something seriously wrong here, or can I safely ignore it? >=20 What do you see if you try and read the contents of those files? Smells like a filesystem problem to me, in which case you should unmount that partition (given it's /usr that implies taking the system down to single user mode) and run fsck against it repeatedly until fsck tells you the filesystem is clean. I'm assuming this is a UFS system -- if it's ZFS then none of the above applies, but also, you probably wouldn't see an error like that either. Cheers, Matthew --wETofr9M988tXjPfC0cpsSKHcqXgRfI7q Content-Type: application/pgp-signature; name="signature.asc" Content-Description: OpenPGP digital signature Content-Disposition: attachment; filename="signature.asc" -----BEGIN PGP SIGNATURE----- Version: GnuPG v2 Comment: Using GnuPG with Thunderbird - http://www.enigmail.net/ iQJ8BAEBCgBmBQJTtTCdXxSAAAAAAC4AKGlzc3Vlci1mcHJAbm90YXRpb25zLm9w ZW5wZ3AuZmlmdGhob3JzZW1hbi5uZXQxOUYxNTRFQ0JGMTEyRTUwNTQ0RTNGMzAw MDUxM0YxMEUwQTlFNEU3AAoJEABRPxDgqeTn6+sP/iAylYs1/rXqelS7EHUypcA0 Da/efg8pNN0x2nvnfx/XfuDe8EIc84O264BaE9Vw0S8pG64IIlnfeqkjBg21aKJn KHGqjmHnNUuc9wAYKPbwQdag9uGNGTeC5dVs7wR2Y8VNHTl9xkql/HQ8LAK3pdhQ 1qOQ3I8lq4VqyQMlPDI2scNjLqRdT7zosbqVlIDJpfdRqvNLNPdRq9tTVtB2mCMp bd7esnfu8bywdm/1d91vtvZqc0zBK4vdz57mqRkijG1Lg/k3zkMMWqoTMx1/UYBA NnhSQeOgGOKinLDTpbDnLz93X6WehdvDEDgBBDDttqBO3L/CHJcSWBrtiSL29YzL 2Ics7H/7AdFPIjWcFynnLaYoDNt4XdDV1C6l/eOYl/E6Lzo/QAGSS5L8RCpKCpLx gwk/NGoK+C3v3Nqdw2x/UtpNTbq6Qb0v01UcWuDqta1m17ol56q35kMkHVPcqnHS Kcs4Lnx2mJkheIcpwiM7KPUzUA+ImNyiIpQTuml//3P1b0Ucs+6oye+1yWI3xda/ 4uMW5LNnFRChuXGCahEmVddJmBM1l+V+wSVDGqDINuaKgRaajW99DGaL8vWQL+5S rSvUeDqUXmpL/D2PZTycXpKK6aRCyRwuLfsBL6cYu5WB0u6QdiaSIOoFmWFC/Xhh AwKICbGaVHo5qgjnI4ED =OxZy -----END PGP SIGNATURE----- --wETofr9M988tXjPfC0cpsSKHcqXgRfI7q--