From owner-freebsd-stable@FreeBSD.ORG Mon Dec 24 14:57:39 2012 Return-Path: Delivered-To: stable@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [69.147.83.52]) by hub.freebsd.org (Postfix) with ESMTP id 95A01372; Mon, 24 Dec 2012 14:57:39 +0000 (UTC) (envelope-from mi+thun@aldan.algebra.com) Received: from smtp02.lnh.mail.rcn.net (smtp02.lnh.mail.rcn.net [207.172.157.102]) by mx1.freebsd.org (Postfix) with ESMTP id 2AEC98FC0A; Mon, 24 Dec 2012 14:57:38 +0000 (UTC) Received: from mr17.lnh.mail.rcn.net ([207.172.157.37]) by smtp02.lnh.mail.rcn.net with ESMTP; 24 Dec 2012 09:57:38 -0500 Received: from smtp01.lnh.mail.rcn.net (smtp01.lnh.mail.rcn.net [207.172.4.11]) by mr17.lnh.mail.rcn.net (MOS 4.3.4-GA) with ESMTP id BVV29778; Mon, 24 Dec 2012 09:57:37 -0500 X-Auth-ID: anat Received: from pool-173-70-92-11.nwrknj.fios.verizon.net (HELO [192.168.1.8]) ([173.70.92.11]) by smtp01.lnh.mail.rcn.net with ESMTP; 24 Dec 2012 09:57:38 -0500 Message-ID: <50D86D60.2060506@aldan.algebra.com> Date: Mon, 24 Dec 2012 09:57:36 -0500 From: "Mikhail T." User-Agent: Mozilla/5.0 (X11; FreeBSD amd64; rv:14.0) Gecko/20120820 Thunderbird/14.0 MIME-Version: 1.0 To: Chris Rees Subject: Re: What is "negative group permissions"? (Re: narawntapu security run output) References: <201212230805.qBN850Pj083122@narawntapu.narawntapu> <50D7287C.7020802@aldan.algebra.com> <20121223162332.GA38788@pit.databus.com> In-Reply-To: Content-Type: text/plain; charset=KOI8-U; format=flowed Content-Transfer-Encoding: 8bit X-Content-Filtered-By: Mailman/MimeDel 2.1.14 Cc: Barney Wolff , stable@freebsd.org X-BeenThere: freebsd-stable@freebsd.org X-Mailman-Version: 2.1.14 Precedence: list List-Id: Production branch of FreeBSD source code List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 24 Dec 2012 14:57:39 -0000 On 23.12.2012 11:48, Chris Rees wrote: > They involve a lot of thought to get right, as well as chmod g-w on > something where you probably meant chmod go-w is a disastrous but > (perhaps) common error. Chris Well, in (over 20) years of dealing with Unix, I've never made a mistake like that, nor do I understand, how it can be considered "common" ... Got to admit, I was surprised to see it. It made me think, I do not understand something -- or that FreeBSD is becoming overly paternalistic. It turned out to be the latter... I doubt, it is useful. Worse, issuing such warnings routinely, only reinforces the unfortunate misconceptions like the one Barney demonstrated in this thread. When originally added, the check was meant to be off by default: r215213 | brooks | 2010-11-12 19:40:43 -0500 (ΠΤ, 12 ΜΙΣ 2010) | 7 lines Add an (off by default) check for negative permissions (where the group on a object has less permissions that everyone). These permissions will not work reliably over NFS if you have more than 14 supplemental groups and are usually not what you mean. MFC after: 1 week perhaps, it should have remained off? Yours, -mi