From owner-freebsd-current Tue Oct 1 22:13: 8 2002 Delivered-To: freebsd-current@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id 9906937B401 for ; Tue, 1 Oct 2002 22:13:07 -0700 (PDT) Received: from critter.freebsd.dk (critter.freebsd.dk [212.242.86.163]) by mx1.FreeBSD.org (Postfix) with ESMTP id CAF5643E6A for ; Tue, 1 Oct 2002 22:13:06 -0700 (PDT) (envelope-from phk@critter.freebsd.dk) Received: from critter.freebsd.dk (localhost [127.0.0.1]) by critter.freebsd.dk (8.12.6/8.12.6) with ESMTP id g925Cb0U046930; Wed, 2 Oct 2002 07:12:43 +0200 (CEST) (envelope-from phk@critter.freebsd.dk) To: Bruce Evans Cc: Brooks Davis , current@FreeBSD.ORG Subject: Re: HEADSUP! GEOM as default in 5 days... In-Reply-To: Your message of "Wed, 02 Oct 2002 12:42:45 +1000." <20021002122851.K3584-100000@gamplex.bde.org> Date: Wed, 02 Oct 2002 07:12:37 +0200 Message-ID: <46929.1033535557@critter.freebsd.dk> From: Poul-Henning Kamp Sender: owner-freebsd-current@FreeBSD.ORG Precedence: bulk List-ID: List-Archive: (Web Archive) List-Help: (List Instructions) List-Subscribe: List-Unsubscribe: X-Loop: FreeBSD.ORG In message <20021002122851.K3584-100000@gamplex.bde.org>, Bruce Evans writes: >On Tue, 1 Oct 2002, Brooks Davis wrote: > >> I just added options GEOM on a kernel from yesterday and noticed today >> that Amanda failed to dump my disks overnight. The problem is that the >> entries in /dev have the wrong permissions. They should be readable by >> group operator, but here's what I have: >> >> [12:03pm] brooks@minya (/usr/src): ll /dev/ad* >> crw------- 1 root wheel 4, 0 Sep 30 16:10 /dev/ad0 > >One reason I have no confidence in devfs is that its quality is such as >to get things like this wrong. There are magic ownerships and permissions >in the source code for N drivers where they are hard to audit. > >The acd driver still uses the insecure mode 0644 despite this being >reported a few years ago. World readability is especially insecure >for acd since it gives some write access via some ioctls. E.g., >everyone has permission to erase writable media. This is _not_ a DEVFS issue, this is a device driver issue. -- Poul-Henning Kamp | UNIX since Zilog Zeus 3.20 phk@FreeBSD.ORG | TCP/IP since RFC 956 FreeBSD committer | BSD since 4.3-tahoe Never attribute to malice what can adequately be explained by incompetence. To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-current" in the body of the message