Tiger UNIX security tool - Patches: patch #2476, remove the fileutils / LSGROUP...
You are not allowed to post comments on this tracker with your current authentication level.
patch #2476: remove the fileutils / LSGROUP test in the Linux/2/config.
Submitter: | Ryan Bradetich <rbrad> | ||
Submitted: | Wed 14 Jan 2004 06:03:51 AM UTC | ||
Category: | Security test | Priority: | 3 - Low |
Status: | Invalid | Privacy: | Public |
Assigned to: | jfs | Open/Closed: | Open |
Thu 22 Jan 2004 07:25:30 AM UTC, comment #4: |
Ryan Bradetich <rbrad>![]() |
Wed 21 Jan 2004 11:29:42 PM UTC, comment #3: Interesting... Because I actually tested this case (Debian woody :))
|
Ryan Bradetich <rbrad>![]() |
Wed 21 Jan 2004 06:18:41 PM UTC, comment #2: Well, the -g switch was necessary in the latest Debian (which used fileutils (package version 4.1-10) did have issues. You can find the full summary at http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=155588
|
Javier Fernandez-Sanguino Peña <jfs>![]() ![]() |
Tue 20 Jan 2004 09:28:17 PM UTC, comment #1: Committed to cvs HEAD on: 01/20/2004. |
Ryan Bradetich <rbrad>![]() |
Wed 14 Jan 2004 06:03:51 AM UTC, original submission:
This patch forces the LSGROUP variable to just "-l". The prevsious version performed a version check on fileutils and set LSGROUP="-lg" if the version was betwee 4.0 and 4.10.
|
Ryan Bradetich <rbrad>![]() |
Depends on the following items: None found
Items that depend on this one: None found
There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.
I went back and looked at the bug report in additional detail and think I found the problem:
[This is from the bug report jfs posted.]
drwxr-sr-x 6 aalonso 4096 2002-07-17 23:37 /home/aalonso
Notice here that the group is NOT replaced by a number, instead the file owner is plain missing. The above command has one less field then the command below.
drwxr-sr-x 6 aalonso aalonso 4096 jul 17 23:37 /home/aalonso
The problem is the same problem I have run into with RedHat, SuSE, etc. Newer versions of ls do not display the owner if the -g option is given.
Here is the what the man page says about -g for the ls command on newer versions of ls:
-g like -l, but do not list owner
I believe my origional patch is correct for the following reason:
Every place the $LSGROUP is used we are interested in parsing the file owner. So specifying the -g option is either ignored (older versions) or does not display the file owner.
removing the -g makes the ls command work correctly in all cases.