From owner-freebsd-arch@FreeBSD.ORG Wed May 23 17:39:15 2007 Return-Path: X-Original-To: freebsd-arch@freebsd.org Delivered-To: freebsd-arch@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [69.147.83.52]) by hub.freebsd.org (Postfix) with ESMTP id 6A5FD16A400 for ; Wed, 23 May 2007 17:39:15 +0000 (UTC) (envelope-from cperciva@freebsd.org) Received: from pd2mo3so.prod.shaw.ca (shawidc-mo1.cg.shawcable.net [24.71.223.10]) by mx1.freebsd.org (Postfix) with ESMTP id 46CE313C489 for ; Wed, 23 May 2007 17:39:15 +0000 (UTC) (envelope-from cperciva@freebsd.org) Received: from pd4mr2so.prod.shaw.ca (pd4mr2so-qfe3.prod.shaw.ca [10.0.141.213]) by l-daemon (Sun ONE Messaging Server 6.0 HotFix 1.01 (built Mar 15 2004)) with ESMTP id <0JII00EWT693DAJN@l-daemon> for freebsd-arch@freebsd.org; Wed, 23 May 2007 10:39:03 -0600 (MDT) Received: from pn2ml1so.prod.shaw.ca ([10.0.121.145]) by pd4mr2so.prod.shaw.ca (Sun Java System Messaging Server 6.2-7.05 (built Sep 5 2006)) with ESMTP id <0JII0020B68YHLH1@pd4mr2so.prod.shaw.ca> for freebsd-arch@freebsd.org; Wed, 23 May 2007 10:38:59 -0600 (MDT) Received: from hexahedron.daemonology.net ([24.82.18.31]) by l-daemon (Sun ONE Messaging Server 6.0 HotFix 1.01 (built Mar 15 2004)) with SMTP id <0JII00F1O68XZTQ1@l-daemon> for freebsd-arch@freebsd.org; Wed, 23 May 2007 10:38:58 -0600 (MDT) Received: (qmail 1618 invoked from network); Wed, 23 May 2007 16:38:46 +0000 Received: from unknown (HELO hexahedron.daemonology.net) (127.0.0.1) by localhost with SMTP; Wed, 23 May 2007 16:38:46 +0000 Date: Wed, 23 May 2007 09:38:46 -0700 From: Colin Percival To: "freebsd-arch@freebsd.org" Message-id: <46546E16.9070707@freebsd.org> MIME-version: 1.0 Content-type: text/plain; charset=ISO-8859-1 Content-transfer-encoding: 7bit X-Enigmail-Version: 0.95.0 User-Agent: Thunderbird 2.0.0.0 (X11/20070511) Cc: Subject: RFC: Removing file(1)+libmagic(3) from the base system X-BeenThere: freebsd-arch@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Discussion related to FreeBSD architecture List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 23 May 2007 17:39:15 -0000 FreeBSD architects and file(1) maintainer, I'd like to remove file(1) and libmagic(3) from the FreeBSD base system for the following reasons: 1. I don't see it as being a necessary component of a UNIX-like operating system. 2. It's available in the ports tree. 3. Due to its nature as a program which parses multiple data formats, it poses an unusually high risk of having security problems in the future (cf. ethereal/wireshark). The one redeeming feature of file/libmagic as far as security is concerned is that it doesn't act as a daemon, i.e., other code or user intervention is required for an attacker to exploit security issues. This is why I'm asking here rather than wielding the "Security Officer can veto code which he doesn't like" stick. :-) Can anyone make a strong argument for keeping this code in the base system? Colin Percival FreeBSD Security Officer