diff options
| author | tron <tron@NetBSD.org> | 2006-09-26 08:32:40 +0000 |
|---|---|---|
| committer | tron <tron@NetBSD.org> | 2006-09-26 08:32:40 +0000 |
| commit | 820a357648b6fa9436bbf3acfe8ef0fff7edd8fd (patch) | |
| tree | d766c93ca1413028503b4875b3b7425098c390fd /etc/security | |
| parent | c7e71f1d87367daa0134db86c2b8c7aa6b13cde0 (diff) | |
Improve security check for "/etc/exports":
1.) Properly handle line continuation and network exports.
2.) Make the report more compact.
Patch contributed by Jukka Salmi in PR bin/24583.
Diffstat (limited to 'etc/security')
| -rw-r--r-- | etc/security | 48 |
1 files changed, 37 insertions, 11 deletions
diff --git a/etc/security b/etc/security index 2db52e9d0ef..d062d892999 100644 --- a/etc/security +++ b/etc/security @@ -1,6 +1,6 @@ #!/bin/sh - # -# $NetBSD: security,v 1.99 2006/09/23 04:07:01 jmcneill Exp $ +# $NetBSD: security,v 1.100 2006/09/26 08:32:40 tron Exp $ # from: @(#)security 8.1 (Berkeley) 6/9/93 # @@ -583,20 +583,46 @@ if checkyesno check_nfs && [ -f /etc/exports ]; then # ignore comments and blank lines if ($0 ~ /^\#/ || $0 ~ /^$/ ) next; + # manage line continuation + while ($NF ~ /^\\$/) { + $NF = ""; + line = $0 ""; + getline; + $0 = line $0 ""; + } - readonly = 0; - for (i = 2; i <= NF; ++i) { - if ($i ~ /-ro/) - readonly = 1; - else if ($i ~ /^-network=/) - next; - else if ($i !~ /^-/) - next; + delete dir; + readonly = ndir = 0; + for (i = 1; i <= NF; ++i) { + if ($i ~ /^\//) dir[ndir++] = $i; + else if ($i ~ /^-/) { + if ($i ~ /^-(ro|o)$/) readonly = 1; + if ($i ~ /^-network/) next; + } + else next; } if (readonly) - print "File system " $1 " globally exported, read-only." + for (item in dir) + rodir[nrodir++] = dir[item]; else - print "File system " $1 " globally exported, read-write." + for (item in dir) + rwdir[nrwdir++] = dir[item]; + + } + + END { + if (nrodir) { + printf("Globally exported file system%s, read-only:\n", + nrodir > 1 ? "s" : ""); + for (item in rodir) + printf("\t%s\n", rodir[item]); + } + if (nrwdir) { + printf("Globally exported file system%s, read-write:\n", + nrwdir > 1 ? "s" : ""); + for (item in rwdir) + printf("\t%s\n", rwdir[item]); + } }' < /etc/exports > $OUTPUT if [ -s $OUTPUT ] ; then printf "\nChecking for globally exported file systems.\n" |
