Date: Thu, 1 Jun 2000 17:30:10 +0100 (BST) From: dwmalone@maths.tcd.ie To: FreeBSD-gnats-submit@freebsd.org Subject: misc/18947: daily security script should list inode numbers? Message-ID: <200006011730.aa96531@walton.maths.tcd.ie>
next in thread | raw e-mail | index | archive | help
>Number: 18947 >Category: misc >Synopsis: daily security script should list inode numbers? >Confidential: no >Severity: non-critical >Priority: low >Responsible: freebsd-bugs >State: open >Quarter: >Keywords: >Date-Required: >Class: change-request >Submitter-Id: current-users >Arrival-Date: Thu Jun 01 09:40:00 PDT 2000 >Closed-Date: >Last-Modified: >Originator: David Malone >Release: FreeBSD 3.4-STABLE i386 >Organization: School of Mathematics, Trinity College, Dublin. >Environment: {3,4,5}.X >Description: The nightly security script remembers lots of stuff about all the setuid files it finds, using "ls -lTd", remembering the inode number of these files could be useful too. After all, if the inode number has changed and nothing else you've either just restored from a backup, or something strange is afoot! >How-To-Repeat: Have script kiddies use a badly written timestamp fixing program on a suid program. >Fix: =================================================================== RCS file: security,v retrieving revision 1.38 diff -u -r1.38 security --- security 2000/04/06 10:46:50 1.38 +++ security 2000/06/01 16:16:14 @@ -35,7 +35,7 @@ find $mount -xdev -type f \ \( -perm -u+x -or -perm -g+x -or -perm -o+x \) \ \( -perm -u+s -or -perm -g+s \) -print0 -done | xargs -0 -n 20 ls -lTd | sort +9 > ${TMP} +done | xargs -0 -n 20 ls -liTd | sort +10 > ${TMP} if [ ! -f ${LOG}/setuid.today ]; then separator >Release-Note: >Audit-Trail: >Unformatted: To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-bugs" in the body of the message
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?200006011730.aa96531>