Subject: Re: CRITICAL ** Holes in default cron jobs ** CRITICAL
To: Michael Richardson <email@example.com>
From: Giles Lean <firstname.lastname@example.org>
Date: 12/30/1996 07:49:33
On Sun, 29 Dec 1996 13:47:05 -0500 Michael Richardson wrote:
> >(find / ! -fstype local -a -prune -o \
> > \( -perm -u+s -o -perm -g+s -o ! -type d -a ! -type f -a ! -type l -a \
> > ! -type s \) | \
> >sort | sed -e 's/^/ls -ldgT /' | sh > $LIST) 2> $OUTPUT
> Uh, isn't this missing a -print *anyway* ???
> I wasn't able to exploit this until I added one.
Find adds -print automatically; exploiting it worked just fine.
OpenBSD has added -print0 to find(1) and -0 to xargs(1), based on the
NetBSD versions of find and xargs. These sources compile cleanly on
NetBSD (at least on 1.1 -- I haven't upgraded to 1.2 yet).
Anyone want a re-written /etc/security that uses these?