Hi,

Though I posted this report before, I got no responses.


The following games are installed with unexpected permission.

-r-xr-xr-x  1 root  wheel   45056 Apr  4 17:36 /usr/games/hide/atc
-r-xr-xr-x  1 root  wheel   24576 Apr  4 17:36 /usr/games/hide/boggle
-r-xr-xr-x  1 root  wheel   28672 Apr  4 17:36 /usr/games/hide/cribbage
-r-xr-xr-x  1 root  wheel   16384 Apr  4 17:36 /usr/games/hide/fish
-r-xr-xr-x  1 root  wheel  221184 Apr  4 17:36 /usr/games/hide/hack
-r-xr-xr-x  1 root  wheel  135168 Apr  4 17:36 /usr/games/hide/larn
-r-xr-xr-x  1 root  wheel   32768 Apr  4 17:36 /usr/games/hide/monop
-r-xr-xr-x  1 root  wheel   16384 Apr  4 17:36 /usr/games/hide/quiz
-r-xr-xr-x  1 root  wheel   20480 Apr  4 17:36 /usr/games/hide/wump

For example, there is `HIDEGAME=hidegame' in `src/games/fish/Makefile'.
But `BINMODE' is defined by `.include <bsd.own.mk>'.  So then the
definition of `BINMODE?=550' in `src/games/Makefile.inc' is ignored.

By the way, is `BINMODE?=550' needed?  Because `/usr/games/hide'
is `drwxr-x---', normal user can't read/exec the programs.

In addition, if the games are controlled by dm(8), are setgids
needed?  In fact, though /usr/games/rogue isn't set[ug]id
(It may be a bug, because there is `SET*U*IDGAME=yes' in Makefile),

-r-xr-x---  1 root  games  106496 Apr  4 17:36 /usr/games/hide/rogue

normal user can record the score to `/var/games/rogue.scores'.

-- 
nakayosh@kcn.ne.jp