From owner-cvs-all Mon Feb 12 8:58: 5 2001 Delivered-To: cvs-all@freebsd.org Received: from mobile.wemm.org (c1315225-a.plstn1.sfba.home.com [65.0.135.147]) by hub.freebsd.org (Postfix) with ESMTP id 247DD37B4EC; Mon, 12 Feb 2001 08:57:56 -0800 (PST) Received: from netplex.com.au (localhost [127.0.0.1]) by mobile.wemm.org (8.11.1/8.11.1) with ESMTP id f1CGvtU51868; Mon, 12 Feb 2001 08:57:55 -0800 (PST) (envelope-from peter@netplex.com.au) Message-Id: <200102121657.f1CGvtU51868@mobile.wemm.org> X-Mailer: exmh version 2.2 06/23/2000 with nmh-1.0.4 To: Robert Watson Cc: Warner Losh , Peter Pentchev , Dag-Erling Smorgrav , cvs-committers@FreeBSD.org, cvs-all@FreeBSD.org Subject: Re: cvs commit: src/sys/vm vm_zone.c vm_zone.h In-Reply-To: <200102121653.f1CGr5U51782@mobile.wemm.org> Date: Mon, 12 Feb 2001 08:57:55 -0800 From: Peter Wemm Sender: owner-cvs-all@FreeBSD.ORG Precedence: bulk X-Loop: FreeBSD.ORG Peter Wemm wrote: > Robert Watson wrote: > > > > On Mon, 12 Feb 2001, Peter Wemm wrote: > > > > > Warner Losh wrote: > > > > In message > Rob > > > ert Watson writes: > > > > : appreciated. (this will also make it easier for portable kernel > > > > : monitoring tools to be written, and allow graphical monitoring tools to > > > > : run with less privilege). > > > > > > > > And generally make for a happier security officer team :-) > > > > > > And an unhappier team of people dealing with kernel crashdumps. :-( > > > > > > All this sysctl stuff is fine, but dont kill the crashdump reading code! > > > If -M or -N are specified then use the old way (and require root to be > > > running it). Without -M or -N, use sysctl. > > > > All patches submitted on the freebsd-audit mailing list to remove setgid > > from top, systat, dmesg, etc, have maintained backwards compatibility by > > using kmem when the -M or -N argument is provided, permitting them to > > continue to work on system dumps -- and even on /dev/kmem, it just > > requires that you run them as root now, since they won't be setgid kmem. > > If you have a few minutes and want to verify that the new versions will > > continue to work properly for you, and that you think they're implemented > > right, the archives of -audit contain a number of relevant posts by Thomas > > Moestl . > > netstat(1) is a high profile tool that got broken this way and is sorely > missed here. At work we reverted the sysctl changes entirely for > simplicity. Specifically, this one: revision 1.27 date: 1998/05/15 20:19:15; author: wollman; state: Exp; lines: +115 -62 mbuf, inet, and unix modules no longer read kvm. Paul Saab has a version that restored this stuff specifically for crashdump use. (which gets a *lot* of use) Cheers, -Peter -- Peter Wemm - peter@FreeBSD.org; peter@yahoo-inc.com; peter@netplex.com.au "All of this is for nothing if we don't go to the stars" - JMS/B5 To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe cvs-all" in the body of the message