Merged our changes back into 4.4BSD version.

Can't do "find -ls" since we need to store the date in an absolute format
(ls -T).  Use "find -print0" | xargs -0 instead.

1 files changed, 49 insertions, 46 deletions

diff --git a/etc/security b/etc/security
index 464981e2291..50e1965d934 100644
--- a/etc/security
+++ b/etc/security
@@ -1,7 +1,9 @@
 #!/bin/sh -
 #
-#	$OpenBSD: security,v 1.12 1996/11/23 19:10:43 millert Exp $
+#	$OpenBSD: security,v 1.13 1996/11/30 17:50:58 millert Exp $
+#	from: @(#)security	8.1 (Berkeley) 6/9/93
 #
+
 PATH=/sbin:/usr/sbin:/bin:/usr/bin
 
 umask 077
@@ -14,7 +16,6 @@ TMP3=$DIR/_secure4
 LIST=$DIR/_secure5
 OUTPUT=$DIR/_secure6
 
-
 if ! mkdir $DIR ; then
 	printf "tmp directory %s already exists, looks like:\n" $DIR
 	ls -alF $DIR
@@ -35,7 +36,7 @@ awk -F: '{
 	if ($1 ~ /^[+-].*$/)
 		next;
 	if ($1 == "")
-		printf("Line %d has an empty login field.\n",NR);
+		printf("Line %d has an empty login field.\n", NR);
 	else if ($1 !~ /^[A-Za-z0-9][A-Za-z0-9_-]*$/)
 		printf("Login %s has non-alphanumeric characters.\n", $1);
 	if (length($1) > 8)
@@ -104,7 +105,7 @@ awk -F: '{
 		next;
 	if (NF != 4)
 		printf("Line %d has the wrong number of fields.\n", NR);
-	if ($1 !~ /^[A-za-z0-9]*$/)
+	if ($1 !~ /^[A-za-z0-9][A-za-z0-9_-]*$/)
 		printf("Group %s has non-alphanumeric characters.\n", $1);
 	if (length($1) > 8)
 		printf("Group %s has more than 8 characters.\n", $1);
@@ -160,7 +161,7 @@ end-of-csh
 done
 if [ $umaskset = "no" -o -s $OUTPUT ] ; then
 	printf "\nChecking root csh paths, umask values:\n$list\n"
-	if [ -s $OUTPUT ]; then
+	if [ -s $OUTPUT ] ; then
 		cat $OUTPUT
 	fi
 	if [ $umaskset = "no" ] ; then
@@ -204,7 +205,7 @@ end-of-sh
 done
 if [ $umaskset = "no" -o -s $OUTPUT ] ; then
 	printf "\nChecking root sh paths, umask values:\n$list\n"
-	if [ -s $OUTPUT ]; then
+	if [ -s $OUTPUT ] ; then
 		cat $OUTPUT
 	fi
 	if [ $umaskset = "no" ] ; then
@@ -234,17 +235,17 @@ list="/etc/hosts.equiv /etc/shosts.equiv /etc/hosts.lpd"
 for f in $list ; do
 	if [ -s $f ] ; then
 		awk '{
-			if ($0 ~ /^\+@.*$/ )
+			if ($0 ~ /^\+@.*$/)
 				next;
-			if ($0 ~ /^\+.*$/ )
+			if ($0 ~ /^\+.*$/)
 				printf("\nPlus sign in %s file.\n", FILENAME);
 		}' $f
 	fi
 done
 
-# Check for special users with .rhosts/.shosts files.  Only root should
-# have .rhosts/.shosts files.  Also, .rhosts/.shosts files
-# should not have plus signs.
+# Check for special users with .rhosts/.shosts files.  Only root
+# should have .rhosts/.shosts files.  Also, .rhosts/.shosts
+# files should not have plus signs.
 awk -F: '$1 != "root" && $1 !~ /^[+-].*$/ && \
 	($3 < 100 || $1 == "ftp" || $1 == "uucp") \
 		{ print $1 " " $6 }' /etc/passwd |
@@ -264,13 +265,13 @@ fi
 awk -F: '{ print $1 " " $6 }' /etc/passwd | \
 while read uid homedir; do
 	for j in .rhosts .shosts; do
-		if [ -f ${homedir}/$j ] ; then
+		if [ -s ${homedir}/$j ] ; then
 			awk '{
 				if ($0 ~ /^+@.*$/ )
 					next;
 				if ($0 ~ /^\+[ 	]*$/ )
 					printf("%s has + sign in it.\n",
-					    FILENAME);
+						FILENAME);
 			}' ${homedir}/$j
 		fi
 	done
@@ -282,7 +283,7 @@ fi
 
 # Check home directories.  Directories should not be owned by someone else
 # or writeable.
-awk -F: '{ if ( $1 !~ /^[+-].*$/ ) print $1 " " $6 }' /etc/passwd | \
+awk -F: '{ if ($1 !~ /^[+-].*$/) print $1 " " $6 }' /etc/passwd | \
 while read uid homedir; do
 	if [ -d ${homedir}/ ] ; then
 		file=`ls -ldgT ${homedir}`
@@ -313,6 +314,8 @@ while read uid homedir; do
 done |
 awk '$1 != $5 && $5 != "root" \
 	{ print "user " $1 " " $2 " file is owned by " $5 }
+     $3 ~ /^-...r/ \
+	{ print "user " $1 " " $2 " file is group readable" }
      $3 ~ /^-......r/ \
 	{ print "user " $1 " " $2 " file is other readable" }
      $3 ~ /^-....w/ \
@@ -354,36 +357,36 @@ if [ -s $OUTPUT ] ; then
 	cat $OUTPUT
 fi
 
-if [ -f /etc/exports ]; then
-    # File systems should not be globally exported.
-    awk '{
-	if ($1 ~ /^#/)
-		next;
-	readonly = 0;
-	for (i = 2; i <= NF; ++i) {
-		if ($i ~ /-ro/)
-			readonly = 1;
-		else if ($i !~ /^-/)
+# File systems should not be globally exported.
+if [ -s /etc/exports ] ; then
+	awk '{
+		if ($1 ~ /^#/)
 			next;
-	}
-	if (readonly)
-		print "File system " $1 " globally exported, read-only."
-	else
-		print "File system " $1 " globally exported, read-write."
-    }' < /etc/exports > $OUTPUT
-    if [ -s $OUTPUT ] ; then
-	printf "\nChecking for globally exported file systems.\n"
-	cat $OUTPUT
-    fi
+		readonly = 0;
+		for (i = 2; i <= NF; ++i) {
+			if ($i ~ /-ro/)
+				readonly = 1;
+			else if ($i !~ /^-/)
+				next;
+		}
+		if (readonly)
+			print "File system " $1 " globally exported, read-only."
+		else
+			print "File system " $1 " globally exported, read-write."
+	}' < /etc/exports > $OUTPUT
+	if [ -s $OUTPUT ] ; then
+		printf "\nChecking for globally exported file systems.\n"
+		cat $OUTPUT
+	fi
 fi
 
 # Display any changes in setuid/setgid files and devices.
 pending="\nChecking setuid/setgid files and devices:\n"
 (find / \( ! -fstype local -o -fstype fdesc -o -fstype kernfs \
-		-o -fstype procfs \) -a -prune -o \
-	-type f -a \( -perm -u+s -o -perm -g+s \) -ls -o \
-	! -type d -a ! -type f -a ! -type l -a ! -type s -ls | \
-sort > $LIST) 2> $OUTPUT
+	-o -fstype procfs \) -a -prune -o \
+	-type f -a \( -perm -u+s -o -perm -g+s \) -print0 -o \
+	! -type d -a ! -type f -a ! -type l -a ! -type s -print0 | \
+xargs -0 ls -ldgT | sort +9 > $LIST) 2> $OUTPUT
 
 # Display any errors that occurred during system file walk.
 if [ -s $OUTPUT ] ; then
@@ -394,7 +397,7 @@ if [ -s $OUTPUT ] ; then
 fi
 
 # Display any changes in the setuid/setgid file list.
-egrep -v '^ *[0-9]+ +[0-9]+ +[bc]' $LIST > $TMP1
+egrep -v '^[bc]' $LIST > $TMP1
 if [ -s $TMP1 ] ; then
 	# Check to make sure uudecode isn't setuid.
 	if grep -w uudecode $TMP1 > /dev/null ; then
@@ -410,7 +413,7 @@ if [ -s $TMP1 ] ; then
 			:
 		else
 			> $TMP2
-			join -112 -212 -v2 $CUR $TMP1 > $OUTPUT
+			join -110 -210 -v2 $CUR $TMP1 > $OUTPUT
 			if [ -s $OUTPUT ] ; then
 				printf "${pending}Setuid additions:\n"
 				pending=
@@ -418,7 +421,7 @@ if [ -s $TMP1 ] ; then
 				printf "\n"
 			fi
 
-			join -112 -212 -v1 $CUR $TMP1 > $OUTPUT
+			join -110 -210 -v1 $CUR $TMP1 > $OUTPUT
 			if [ -s $OUTPUT ] ; then
 				printf "${pending}Setuid deletions:\n"
 				pending=
@@ -426,7 +429,7 @@ if [ -s $TMP1 ] ; then
 				printf "\n"
 			fi
 
-			sort +11 $TMP2 $CUR $TMP1 | \
+			sort +9 $TMP2 $CUR $TMP1 | \
 			    sed -e 's/[	 ][	 ]*/ /g' | uniq -u > $OUTPUT
 			if [ -s $OUTPUT ] ; then
 				printf "${pending}Setuid changes:\n"
@@ -450,7 +453,7 @@ fi
 # Check for block and character disk devices that are readable or writeable
 # or not owned by root.operator.
 >$TMP1
-DISKLIST="dk fd hd hk hp jb kra ra rb rd rl rx xd rz sd up wd vnd ccd"
+DISKLIST="ccd dk fd hd hk hp jb kra ra rb rd rl rx rz sd up vnd wd xd"
 for i in $DISKLIST; do
 	egrep "^b.*/${i}[0-9][0-9]*[a-p]$"  $LIST >> $TMP1
 	egrep "^c.*/r${i}[0-9][0-9]*[a-p]$"  $LIST >> $TMP1
@@ -527,7 +530,7 @@ fi
 # the hacker can modify the tree specification to match the replaced binary.
 # For details on really protecting yourself against modified binaries, see
 # the mtree(8) manual page.
-if [ -d /etc/mtree ]; then
+if [ -d /etc/mtree ] ; then
 	cd /etc/mtree
 	mtree -e -p / -f /etc/mtree/special > $OUTPUT
 	if [ -s $OUTPUT ] ; then
@@ -540,7 +543,7 @@ if [ -d /etc/mtree ]; then
 		[ $file = '*.secure' ] && continue
 		tree=`sed -n -e '3s/.* //p' -e 3q $file`
 		mtree -f $file -p $tree > $TMP1
-		if [ -s $TMP1 ]; then
+		if [ -s $TMP1 ] ; then
 			printf "\nChecking $tree:\n" >> $OUTPUT
 			cat $TMP1 >> $OUTPUT
 		fi
@@ -560,7 +563,7 @@ if [ -s /etc/changelist ] ; then
 	for file in `cat /etc/changelist`; do
 		CUR=/var/backups/`basename $file`.current
 		BACK=/var/backups/`basename $file`.backup
-		if [ -s $file ]; then
+		if [ -s $file ] ; then
 			if [ -s $CUR ] ; then
 				diff $CUR $file > $OUTPUT
 				if [ -s $OUTPUT ] ; then