Bug 194189 - mtree fails to fix permissions
Summary: mtree fails to fix permissions
Status: Closed FIXED
Alias: None
Product: Base System
Classification: Unclassified
Component: bin (show other bugs)
Version: CURRENT
Hardware: Any Any
: --- Affects Some People
Assignee: Brooks Davis
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2014-10-06 15:19 UTC by Brooks Davis
Modified: 2019-01-10 05:23 UTC (History)
8 users (show)

See Also:


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Brooks Davis freebsd_committer 2014-10-06 15:19:56 UTC
Peter Wemm reports:

root@ref11-i386:/tmp # mtree -deU -f /etc/mtree/BSD.var.dist -p /var             
empty:  flags ("schg" is not "none"root@ref11-i386:/tmp #                        
                                                                                 
It just does an exit(0) in the middle of reporting a mismatch and doesn't        
actually fix it.                                                                 
                                                                                 
On 10.x:                                                                         
./etc/rc.conf.d missing (created)                                                
audit:  gid (77, 0, modified)                                                    
        permissions (0750, 0755, modified)                                       
empty:  permissions (0555, 0755, modified)                                       
        flags ("schg" is not "uarch", modified to "none")                        
./db/hyperv missing (created)                                                    
./lib/compat/aout missing (created)                                              
                                                                                 
Repeating the run on 10.x gives the same error as on 11.                         
                                                                                 
or 9.x:                                                                          
audit changed                                                                    
        gid expected 77 found 0 modified                                         
        permissions expected 0750 found 0755 modified                            
empty changed                                                                    
        permissions expected 0555 found 0755 modified                            
        flags expected "schg" found "none" modified                              
./lib/compat/aout missing (created)
Comment 1 Brooks Davis freebsd_committer 2014-10-06 15:20:26 UTC
Reproduction case from Peter:

It's even more bizzare than I thought.  Here's how you can see it in action:     
                                                                                 
root@ref11-amd64:/home/peter # chmod 755 /var/empty                              
root@ref11-amd64:/home/peter # mtree -deU -f /etc/mtree/BSD.var.dist -p /var     
empty:  permissions (0555, 0755, modified)                                       
        flags ("schg" is not "uarch", modified to "none")                        
root@ref11-amd64:/home/peter # mtree -deU -f /etc/mtree/BSD.var.dist -p /var     
empty:  flags ("schg" is not "none"root@ref11-amd64:/home/peter #
Comment 2 Marcus Reid 2015-02-13 06:21:02 UTC
I think this might explain why /var/empty is not schg on most of my recent machines.
Comment 3 guyyur 2015-04-14 21:22:28 UTC
According to mtree(8), mtree requires -i to enable setting schg flag.
(fmtree didn't need it and mtree -F freebsd9 adds -i implicitly
when -U/-u is given)

Patch to add '-i' to mtree invocation in etc/Makefile and etc/rc.d/var
https://github.com/guyyur/freebsd-src_patches/blob/master/mtree_missing_i.patch



Patch to fix some of the printing issues when changing flags
and more closely match fmtree syntax when using freebsd9 flavor.
https://github.com/guyyur/freebsd-src_patches/blob/master/mtree_flags_change_prints.patch

Example problems with the prints:
Missing right parenthesis and \n in the line:
  empty:  flags ("schg" is not "none"

Extra right parenthesis when using freebsd9 flavor:
empty changed
        flags expected "schg" found "none", modified to "schg")
Comment 4 Adam McDougall 2015-06-15 22:54:49 UTC
Can this be looked at again in time for 10.2?  Do you need me to test the patches that someone else added?  Thanks.
Comment 5 Glen Barber freebsd_committer 2015-07-02 23:32:51 UTC
Added secteam@ in addition to re@, because I remember this came up during the 10.0-RELEASE cycle when mtree(8) was changed.

I am still trying to locate the thread (internal to re@ and secteam@, if I recall correctly), and my recollection was that we decided this is a non-issue (specifically referencing schg on /var/empty) security-wise.

Using DragonflyBSD, NetBSD, and OpenBSD as a reference points, OpenBSD does not set schg on /var/emtpy (as far as I am able to tell) but DragonflyBSD does.

I cannot even find references to /var/empty in NetBSD's mtree files.
Comment 6 Xin LI freebsd_committer 2015-07-03 00:42:38 UTC
(In reply to Glen Barber from comment #5)
I don't think there is security implications per se for /var/empty but it's rather inconvenient because /var/empty is supposed to be always empty (therefore there is a schg flag).  I think it's reasonable to adopt at least the first change in commit #3.

By the way, silently not setting flags when it's specified by the mtree seems dangerous to me, as the system administrator may intend to do it and expect it work but get no warning for that.
Comment 7 commit-hook freebsd_committer 2015-11-09 23:37:27 UTC
A commit references this bug:

Author: bdrewery
Date: Mon Nov  9 23:37:01 UTC 2015
New revision: 290628
URL: https://svnweb.freebsd.org/changeset/base/290628

Log:
  When extracting mtrees, pass -i so schg/sappnd are respected.

  This fixes /var/empty not being schg in the installation.

  This was a change from fmtree to nmtree, that -i is now required to
  apply these flags.

  PR:		194189
  Submitted by:	guyyur@gmail.com
  MFC after:	2 weeks
  Relnotes:	yes

Changes:
  head/etc/Makefile
  head/etc/rc.d/var
Comment 8 commit-hook freebsd_committer 2015-11-12 17:11:33 UTC
A commit references this bug:

Author: bdrewery
Date: Thu Nov 12 17:11:03 UTC 2015
New revision: 290718
URL: https://svnweb.freebsd.org/changeset/base/290718

Log:
  Respect NO_FSCHG for extracting mtrees.

  PR:		194189
  X-MFC-With:	r290628
  MFC after:	2 weeks
  Sponsored by:	EMC / Isilon Storage Division

Changes:
  head/etc/Makefile
Comment 9 commit-hook freebsd_committer 2015-11-16 20:19:27 UTC
A commit references this bug:

Author: bdrewery
Date: Mon Nov 16 20:18:38 UTC 2015
New revision: 290943
URL: https://svnweb.freebsd.org/changeset/base/290943

Log:
  Avoid FSCHG for INSTALL_AS_USER as well.

  PR:		194189
  X-MFC-With:	r290628
  MFC after:	2 weeks
  Sponsored by:	EMC / Isilon Storage Division

Changes:
  head/etc/Makefile
Comment 10 Brooks Davis freebsd_committer 2019-01-10 05:23:22 UTC
This seems to have been fixed in practice.  Technically requiring -i is a regression, but relative to a release the dropped out of support several years ago...