svn commit: r350878 - in stable/12: . etc/mtree libexec/rc/rc.d usr.sbin/periodic/etc/daily
Ian Lepore
ian at FreeBSD.org
Sun Aug 11 23:01:32 UTC 2019
Author: ian
Date: Sun Aug 11 23:01:31 2019
New Revision: 350878
URL: https://svnweb.freebsd.org/changeset/base/350878
Log:
MFC r349807, r349974, r349976, r350324, r350361, r350445
r349807:
Eliminate spurious periodic.daily error message for rotating accounting log.
In 2011, r218961 removed local code for rotating logs in favor of using the
rotate_log command in etc/rc.d/accounting. If the accounting service is
activated then subsequently de-activated in rc.conf but still remains active
in periodic.conf, then you get an error message every day in the periodic
jobs about being unable to rotate the logs.
With this change to use "onerotate_log", the log rotation will happen the
first time periodic daily runs after accounting was disabled but periodic
accounting was left enabled. After that happens once, the /var/account/acct
will no longer exist, which results in a different path through the periodic
code and no more error messages will appear (unless daily_show_badconfig is
set, in which case the admin will be told that periodic security processing
is enabled but the accounting file is not present).
This is only a partial fix for the problems reported in PR 202203.
PR: 202203
r349974:
Limit access to system accounting files.
In 2013 the security chapter of the Handbook was updated in r42501 to
suggest limiting access to the system accounting file [*1] by creating the
initial file with a mode of 0600. This was in part based on a discussion in
the forums [*2]. Unfortunately, this advice is overridden by the fact that a
new file is created as part of periodic daily processing, and the file mode
is set by the rc.d/accounting script.
These changes update the accounting script to create the directory with mode
0750 if it doesn't already exist, and to create the daily file with mode
0640. This limits write access to root only, read access to root and members
of wheel, and eliminates world access completely. For admins who want to
prevent even members of wheel from accessing the files, the mode of the
/var/account directory can be manually changed to 0700, because the script
never creates or changes that directory if it already exists.
The accounting_rotate_log() function now also handles the error cases of no
existing log file to rotate, and attempting to rotate the file multiple
times (.0 file already exists).
Another small change here eliminates the complexity of the mktemp/chmod/mv
sequence for creating a new acct file by using install(1) with the flags
needed to directly create the file with the desired ownership and
modes. That allows coalescing two separate if checkyesno accounting_enable
blocks into one.
These changes were inspired by my investigation of PR 202203.
[1] https://www.freebsd.org/doc/handbook/security-accounting.html
[2] http://forums.freebsd.org/showthread.php?t=41059
PR: 202203
Differential Revision: https://reviews.freebsd.org/D20876
r349976:
Add an entry mentioning the permission/mode change to daily accounting files.
r350324:
Fix indentation (spaces->tab).
r350361:
Re-wrap the text at 80 columns after fixing the indent in the prior commit.
r350445:
Create the /var/account dir with mode 0750; this is a followup to r349974.
The rc.d/account script contains code to create the /var/account dir, so
it hadn't occurred to me that it is normally created via mtree; thanks to
jilles@ for pointing it out.
Modified:
stable/12/UPDATING
stable/12/etc/mtree/BSD.var.dist
stable/12/libexec/rc/rc.d/accounting
stable/12/usr.sbin/periodic/etc/daily/310.accounting
Directory Properties:
stable/12/ (props changed)
Modified: stable/12/UPDATING
==============================================================================
--- stable/12/UPDATING Sun Aug 11 22:46:58 2019 (r350877)
+++ stable/12/UPDATING Sun Aug 11 23:01:31 2019 (r350878)
@@ -16,6 +16,15 @@ from older versions of FreeBSD, try WITHOUT_CLANG and
the tip of head, and then rebuild without this option. The bootstrap process
from older version of current across the gcc/clang cutover is a bit fragile.
+20190811:
+ Default permissions on the /var/account/acct file (and copies of it
+ rotated by periodic daily scripts) are changed from 0644 to 0640
+ because the file contains sensitive information that should not be
+ world-readable. If the /var/account directory must be created by
+ rc.d/accounting, the mode used is now 0750. Admins who use the
+ accounting feature are encouraged to change the mode of an existing
+ /var/account directory to 0750 or 0700.
+
20190723:
Clang, llvm, lld, lldb, compiler-rt, libc++, libunwind and openmp have
been upgraded to 8.0.1. Please see the 20141231 entry below for
Modified: stable/12/etc/mtree/BSD.var.dist
==============================================================================
--- stable/12/etc/mtree/BSD.var.dist Sun Aug 11 22:46:58 2019 (r350877)
+++ stable/12/etc/mtree/BSD.var.dist Sun Aug 11 23:01:31 2019 (r350878)
@@ -5,7 +5,7 @@
/set type=dir uname=root gname=wheel mode=0755
.
- account
+ account mode=0750
..
at
/set uname=daemon
Modified: stable/12/libexec/rc/rc.d/accounting
==============================================================================
--- stable/12/libexec/rc/rc.d/accounting Sun Aug 11 22:46:58 2019 (r350877)
+++ stable/12/libexec/rc/rc.d/accounting Sun Aug 11 23:01:31 2019 (r350878)
@@ -21,23 +21,27 @@ start_cmd="accounting_start"
stop_cmd="accounting_stop"
rotate_log_cmd="accounting_rotate_log"
+create_accounting_file()
+{
+ install -o root -g wheel -m 0640 /dev/null "${accounting_file}"
+}
+
accounting_start()
{
local _dir
_dir="${accounting_file%/*}"
if [ ! -d "$_dir" ]; then
- if ! mkdir -p "$_dir"; then
+ if ! mkdir -p -m 0750 "$_dir"; then
err 1 "Could not create $_dir."
fi
fi
if [ ! -e "$accounting_file" ]; then
echo -n "Creating accounting file ${accounting_file}"
- touch "$accounting_file"
+ create_accounting_file
echo '.'
fi
- chmod 644 "$accounting_file"
echo "Turning on accounting."
${accounting_command} ${accounting_file}
@@ -51,21 +55,24 @@ accounting_stop()
accounting_rotate_log()
{
- local _dir _file
+ # Note that this function must handle being called as "onerotate_log"
+ # (by the periodic scripts) when accounting is disabled, and handle
+ # being called multiple times (by an admin making mistakes) without
+ # anything having actually rotated the old .0 file out of the way.
- _dir="${accounting_file%/*}"
- cd $_dir
+ if [ -e "${accounting_file}.0" ]; then
+ err 1 "Cannot rotate accounting log, ${accounting_file}.0 already exists."
+ fi
- if checkyesno accounting_enable; then
- _file=`mktemp newacct-XXXXX`
- chmod 644 $_file
- ${accounting_command} ${_dir}/${_file}
+ if [ ! -e "${accounting_file}" ]; then
+ err 1 "Cannot rotate accounting log, ${accounting_file} does not exist."
fi
mv ${accounting_file} ${accounting_file}.0
if checkyesno accounting_enable; then
- mv $_file ${accounting_file}
+ create_accounting_file
+ ${accounting_command} "${accounting_file}"
fi
}
Modified: stable/12/usr.sbin/periodic/etc/daily/310.accounting
==============================================================================
--- stable/12/usr.sbin/periodic/etc/daily/310.accounting Sun Aug 11 22:46:58 2019 (r350877)
+++ stable/12/usr.sbin/periodic/etc/daily/310.accounting Sun Aug 11 23:01:31 2019 (r350878)
@@ -47,7 +47,7 @@ case "$daily_accounting_enable" in
n=$(($n - 1))
done
- /etc/rc.d/accounting rotate_log || rc=3
+ /etc/rc.d/accounting onerotate_log || rc=3
rm -f acct.merge && cp acct.0 acct.merge || rc=3
sa -s $daily_accounting_flags /var/account/acct.merge || rc=3
More information about the svn-src-stable-12
mailing list