[Top][All Lists]

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

Re: can I file sweep / and exclude full pathnames?

From: Thomas Glanzmann
Subject: Re: can I file sweep / and exclude full pathnames?
Date: 28 Dec 2002 20:17:17 GMT
User-agent: slrn/ (Linux)

> I'd like cfengine to sweep the entire filesystem in one shot, but don't
> want to globally allow any file named sudo or su or crontab in any
> directory to have the SUID bit set. Is there a simple way to do it like
> in the first (non-working) example?

Yep there is one. Have look at my config:

#/usr/local.stand, an tg: wegen icipmail/cmqueue s-bits
/ ignore=/local ignore=/src ignore=/mnt ignore=/proj ignore=/autofs
ignore=/home ignore=/proc ignore=/dev ignore=/devices ignore=/usr/local.stand
ignore=/usr/bin/at          ignore=/usr/bin/atq
ignore=/usr/bin/atrm        ignore=/usr/bin/crontab
ignore=/usr/bin/netstat     ignore=/usr/bin/su

But that sux, too. But there should be a way using filters but I didn't figured
it out yet (not even treid hard). But if somebody else does ... please tell me.


Thomas Glanzmann  ++49 (0) 9131 85-27574   Department of Computer Science III
Martensstrasse 3  D-91058 Erlangen Germany   University of Erlangen-Nuremberg
>From address@hidden Mon Dec 30 19:36:09 2002
Received: from list by with tmda-scanned (Exim 4.10.13)
        id 18TAO9-0000B7-00
        for address@hidden; Mon, 30 Dec 2002 19:36:09 -0500
Received: from mail by with spam-scanned (Exim 4.10.13)
        id 18TAO5-0000AG-00
        for address@hidden; Mon, 30 Dec 2002 19:36:08 -0500
Received: from [] (
        by with esmtp (Exim 4.10.13)
        id 18TAHy-0007BT-00
        for address@hidden; Mon, 30 Dec 2002 19:29:46 -0500
Received: from localhost (address@hidden)
        by (8.11.6+Sun/8.11.6) with ESMTP id gBV0Tdc27148
        for <address@hidden>; Mon, 30 Dec 2002 18:29:40 -0600 (CST)
Date: Mon, 30 Dec 2002 18:29:39 -0600 (CST)
From: "Luke A. Kanies" <address@hidden>
X-Sender: address@hidden
To: address@hidden
Message-ID: <address@hidden>
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
Subject: cfenvd and netstat
X-BeenThere: address@hidden
X-Mailman-Version: 2.1b5
Precedence: list
List-Id: Users list for GNU cfengine  <>
List-Help: <mailto:address@hidden>
List-Post: <mailto:address@hidden>
List-Subscribe: <>,
List-Archive: <>
List-Unsubscribe: <>,
X-List-Received-Date: Tue, 31 Dec 2002 00:36:09 -0000

Apparently cfenvd is trying to call netstat, but I don't have netstat in
/usr/ucb, where cfenvd is looking for it.  (I installed a minimal install,
that's why netstat isn't in /ucb.)  I still have a copy in /usr/bin, but i
think it's a bit of a hack just to link it.

Is this a compile-time option, or is it hard-coded?  I didn't see in
available in configure.

I'm using Sparc/Solaris, cfengine-2.0.4.

"Did you know that black paint is an excellent stain remover?"
                                       - Dogbert

reply via email to

[Prev in Thread] Current Thread [Next in Thread]