svn commit: r306642 - stable/11/etc/periodic/security

[Alan Somers]

Author: asomers
Date: Mon Oct  3 14:59:32 2016
New Revision: 306642
URL: https://svnweb.freebsd.org/changeset/base/306642

Log:
  MFC r306048
  
  Fix periodic scripts when an NFS mount covers a local mount
  
  100.chksetuid and 110.neggrpperm try to search through all UFS and ZFS
  filesystems. But their logic contains an error. They also search through
  remote filesystems that are mounted on top of the root of a local
  filesystem. For example, if a user installs a FreeBSD system with the
  default ZFS layout, he'll get a zroot/usr/home filesystem. If he then mounts
  /usr/home over NFS, these scripts would search through /usr/home.

Modified:
  stable/11/etc/periodic/security/100.chksetuid
  stable/11/etc/periodic/security/110.neggrpperm
Directory Properties:
  stable/11/   (props changed)

Modified: stable/11/etc/periodic/security/100.chksetuid
==============================================================================
--- stable/11/etc/periodic/security/100.chksetuid	Mon Oct  3 14:43:57 2016	(r306641)
+++ stable/11/etc/periodic/security/100.chksetuid	Mon Oct  3 14:59:32 2016	(r306642)
@@ -46,7 +46,7 @@ then
 	echo ""
 	echo 'Checking setuid files and devices:'
 	MP=`mount -t ufs,zfs | awk '$0 !~ /no(suid|exec)/ { print $3 }'`
-	find -sx $MP /dev/null -type f \
+	find -sx $MP /dev/null \( ! -fstype local \) -prune -o -type f \
 	    \( -perm -u+x -or -perm -g+x -or -perm -o+x \) \
 	    \( -perm -u+s -or -perm -g+s \) -exec ls -liTd \{\} \+ |
 	check_diff setuid - "${host} setuid diffs:"

Modified: stable/11/etc/periodic/security/110.neggrpperm
==============================================================================
--- stable/11/etc/periodic/security/110.neggrpperm	Mon Oct  3 14:43:57 2016	(r306641)
+++ stable/11/etc/periodic/security/110.neggrpperm	Mon Oct  3 14:59:32 2016	(r306642)
@@ -44,7 +44,7 @@ then
 	echo ""
 	echo 'Checking negative group permissions:'
 	MP=`mount -t ufs,zfs | awk '$0 !~ /no(suid|exec)/ { print $3 }'`
-	n=$(find -sx $MP /dev/null -type f \
+	n=$(find -sx $MP /dev/null \( ! -fstype local \) -prune -o -type f \
 	    \( \( ! -perm +010 -and -perm +001 \) -or \
 	    \( ! -perm +020 -and -perm +002 \) -or \
 	    \( ! -perm +040 -and -perm +004 \) \) \