amd64/154112: user can delete file witch owned by root:wheel

[Ihor R]

>Number:         154112
>Category:       amd64
>Synopsis:       user can delete file witch owned by root:wheel
>Confidential:   no
>Severity:       critical
>Priority:       high
>Responsible:    freebsd-amd64
>State:          open
>Quarter:        
>Keywords:       
>Date-Required:
>Class:          sw-bug
>Submitter-Id:   current-users
>Arrival-Date:   Tue Jan 18 14:50:03 UTC 2011
>Closed-Date:
>Last-Modified:
>Originator:     Ihor R
>Release:        7.3, 8.0, 8.1
>Organization:
GoodNet Ukraine
>Environment:
FreeBSD bravo.goodnet.com.ua 8.0-RELEASE-p4 FreeBSD 8.0-RELEASE-p4 #0: Fri Aug 27 15:53:40 EEST 2010     root at bravo.goodnet.com.ua:/usr/obj/usr/src/sys/BRAVO  amd64

FreeBSD zorro.goodnet.com.ua 7.3-RELEASE-p2 FreeBSD 7.3-RELEASE-p2 #0: Sat Jul 31 13:54:09 EEST 2010     root at zorro.goodnet.com.ua:/usr/obj/usr/src/sys/PAE-DA  i386

FreeBSD sm5.bitte-hosting.com 8.1-RELEASE-p2 FreeBSD 8.1-RELEASE-p2 #0: Fri Jan 14 20:30:40 UTC 2011     Denis at sm5.bitte-hosting.com:/usr/obj/usr/src/sys/KERN-14-01-2011  amd64
>Description:
The broblem is: 
user can delete files in own home directory owned by root:wheel.

>How-To-Repeat:
as root, change current directory to user home :
#cd ~username/
#touch 1.txt
#chown root:wheel 1.txt

login to system as user:
%id
uid=1001(username) gid=1001(username) groups=1001(username)
%ls -la | grep 1.txt
-rw-r--r--    1 root      wheel             0 Jan 18 16:38 1.txt
%rm -f 1.txt
%ls -la | grep 1.txt
%
>Fix:


>Release-Note:
>Audit-Trail:
>Unformatted: