From dwmalone@maths.tcd.ie  Thu Jun  1 09:30:14 2000
Return-Path: <dwmalone@maths.tcd.ie>
Received: from salmon.maths.tcd.ie (salmon.maths.tcd.ie [134.226.81.11])
	by hub.freebsd.org (Postfix) with SMTP id 8FA0037B5ED
	for <FreeBSD-gnats-submit@freebsd.org>; Thu,  1 Jun 2000 09:30:12 -0700 (PDT)
	(envelope-from dwmalone@maths.tcd.ie)
Received: from walton.maths.tcd.ie by salmon.maths.tcd.ie with SMTP
          id <aa00589@salmon>; 1 Jun 2000 17:30:11 +0100 (BST)
Message-Id: <200006011730.aa96531@walton.maths.tcd.ie>
Date: Thu, 1 Jun 2000 17:30:10 +0100 (BST)
From: dwmalone@maths.tcd.ie
Sender: dwmalone@maths.tcd.ie
Reply-To: dwmalone@maths.tcd.ie
To: FreeBSD-gnats-submit@freebsd.org
Subject: daily security script should list inode numbers?
X-Send-Pr-Version: 3.2

>Number:         18947
>Category:       misc
>Synopsis:       daily security script should list inode numbers?
>Confidential:   no
>Severity:       non-critical
>Priority:       low
>Responsible:    dwmalone
>State:          closed
>Quarter:        
>Keywords:       
>Date-Required:  
>Class:          change-request
>Submitter-Id:   current-users
>Arrival-Date:   Thu Jun 01 09:40:00 PDT 2000
>Closed-Date:    Fri Jul 14 12:36:19 PDT 2000
>Last-Modified:  Fri Jul 14 12:36:51 PDT 2000
>Originator:     David Malone
>Release:        FreeBSD 3.4-STABLE i386
>Organization:
School of Mathematics, Trinity College, Dublin.
>Environment:

{3,4,5}.X

>Description:

The nightly security script remembers lots of stuff about all the
setuid files it finds, using "ls -lTd", remembering the inode number
of these files could be useful too. After all, if the inode number
has changed and nothing else you've either just restored from a
backup, or something strange is afoot!

>How-To-Repeat:

Have script kiddies use a badly written timestamp fixing program
on a suid program.

>Fix:

===================================================================
RCS file: security,v
retrieving revision 1.38
diff -u -r1.38 security
--- security	2000/04/06 10:46:50	1.38
+++ security	2000/06/01 16:16:14
@@ -35,7 +35,7 @@
 	find $mount -xdev -type f \
 		\( -perm -u+x -or -perm -g+x -or -perm -o+x \) \
 		\( -perm -u+s -or -perm -g+s \) -print0
-done | xargs -0 -n 20 ls -lTd | sort +9 > ${TMP}
+done | xargs -0 -n 20 ls -liTd | sort +10 > ${TMP}
 
 if [ ! -f ${LOG}/setuid.today ]; then
 	separator

>Release-Note:
>Audit-Trail:
Responsible-Changed-From-To: freebsd-bugs->dwmalone 
Responsible-Changed-By: dwmalone 
Responsible-Changed-When: Tue Jul 11 04:30:15 PDT 2000 
Responsible-Changed-Why:  
My PR. 

http://www.freebsd.org/cgi/query-pr.cgi?pr=18947 
State-Changed-From-To: open->closed 
State-Changed-By: dwmalone 
State-Changed-When: Fri Jul 14 12:36:19 PDT 2000 
State-Changed-Why:  
Commited to RELENG_4 and HEAD. 

http://www.freebsd.org/cgi/query-pr.cgi?pr=18947 
>Unformatted:
