From angio@aros.net  Wed Jun 19 02:40:41 1996
Received: from shell.aros.net (root@shell.aros.net [205.164.111.19])
          by freefall.freebsd.org (8.7.5/8.7.3) with ESMTP id CAA00636
          for <FreeBSD-gnats-submit@freebsd.org>; Wed, 19 Jun 1996 02:40:41 -0700 (PDT)
Received: (from angio@localhost) by shell.aros.net (8.7.5/Unknown) id DAA16261; Wed, 19 Jun 1996 03:40:41 -0600 (MDT)
Message-Id: <199606190940.DAA16261@shell.aros.net>
Date: Wed, 19 Jun 1996 03:40:41 -0600 (MDT)
From: Dave Andersen <angio@aros.net>
Reply-To: angio@aros.net
To: FreeBSD-gnats-submit@freebsd.org
Subject: /etc/security problem with odd filenames.
X-Send-Pr-Version: 3.2

>Number:         1335
>Category:       misc
>Synopsis:       /etc/security generates an error with files with spaces.
>Confidential:   no
>Severity:       non-critical
>Priority:       low
>Responsible:    freebsd-bugs
>State:          closed
>Quarter:
>Keywords:
>Date-Required:
>Class:          sw-bug
>Submitter-Id:   current-users
>Arrival-Date:   Wed Jun 19 02:50:01 PDT 1996
>Closed-Date:    Mon Feb 24 20:37:07 PST 1997
>Last-Modified:  Mon Feb 24 20:37:41 PST 1997
>Originator:     Dave Andersen
>Release:        FreeBSD 2.1-STABLE i386
>Organization:
ArosNet, Inc.
>Environment:

	Nothing relevant.

>Description:

	When /etc/security does its find and xargs, it generates an
	error message when it stumbles upon files with spaces in
	the filename.  The problem is different under -current.

For a file named, alternately, 'A;mail angio < foo'  (with quotes) and 
just   A;mail angio < foo    (no quotes), the security script generated 
this output.

It doesn't appear to pose a security risk, the reason I noticed it in the 
first place.

Stable:
	ls: /usr/home/angio/A;mail angio <foo: No such file or directory
	ls: /usr/home/angio/A;mail: No such file or directory

Current:
	find: /usr/home/angio/A;mail angio < foo: illegal path
	find: /usr/home/angio/'A;mail angio <foo': illegal path


>How-To-Repeat:

	Create a file like the above named files, and make it
	setuid or setgid.

>Fix:
	
	Unknown.

>Release-Note:
>Audit-Trail:
State-Changed-From-To: open->feedback 
State-Changed-By: scrappy 
State-Changed-When: Tue Oct 22 21:12:07 PDT 1996 
State-Changed-Why:  

I've noticed this problem as well, with some files on my system.  Its 
annoying, but is it fixable? 


From: Peter Wemm <peter@spinner.DIALix.COM>
To: "Mark O'Lear" <Mark.Olear@Colorado.EDU>
Cc: "Marc G. Fournier" <scrappy@freefall.freebsd.org>, angio@aros.net,
        freebsd-gnats-submit@freefall.freebsd.org
Subject: Re: misc/1335 
Date: Thu, 24 Oct 1996 23:38:10 +0800

 "Mark O'Lear" wrote:
 > Marc G. Fournier wrote:
 > > 
 > > Synopsis: /etc/security generates an error with files with spaces.
 > > 
 > > State-Changed-From-To: open->feedback
 > > State-Changed-By: scrappy
 > > State-Changed-When: Tue Oct 22 21:12:07 PDT 1996
 > > State-Changed-Why:
 > > 
 > > I've noticed this problem as well, with some files on my system.  Its
 > > annoying, but is it fixable?
 > 
 > It's because of the -X option of find (which tells find to
 > complain if the file has a space, ", or ' in it, because
 > it is passing the results back to xargs).  It would be nice
 > if find had another flag that would return a file name
 > with ' marks around the file name or a \ before the "bad" 
 > character instead of just complaining about it.
 
 IMHO, the 'find -X ... | xargs -n 20 ls -lgTd' is a waste of time.  On my 
 system, the difference between 'find -X ... | xargs -n 20 ..' (as in 
 /etc/security) and the equivalent 'find ... -exec ls -lgTd {} \;' is a 
 whopping 3.32 seconds in total elapsed time.  Beating our brains out on 
 xargs and find -X to save just over 3 lousy seconds hardly seems worth it.
 
 Also, there's "find ... -ls" (as used on OpenBSD)..  The problem with 
 "-ls" is that it doesn't appear to give a complete time output..  ie: it 
 leaves out seconds (ie: "Oct 12 13:34") in the current year, and totally 
 leaves out the time-of-day if it's 6-months older or more (ie: "Dec  2  
 1995").
 
 Cheers,
 -Peter
 
 
State-Changed-From-To: feedback->closed 
State-Changed-By: mpp 
State-Changed-When: Mon Feb 24 20:37:07 PST 1997 
State-Changed-Why:  
Fixed by my recent commit of /etc/security. 
>Unformatted:
