summaryrefslogtreecommitdiff
path: root/etc/security
diff options
context:
space:
mode:
authortron <tron@NetBSD.org>2006-09-26 08:32:40 +0000
committertron <tron@NetBSD.org>2006-09-26 08:32:40 +0000
commit820a357648b6fa9436bbf3acfe8ef0fff7edd8fd (patch)
treed766c93ca1413028503b4875b3b7425098c390fd /etc/security
parentc7e71f1d87367daa0134db86c2b8c7aa6b13cde0 (diff)
Improve security check for "/etc/exports":
1.) Properly handle line continuation and network exports. 2.) Make the report more compact. Patch contributed by Jukka Salmi in PR bin/24583.
Diffstat (limited to 'etc/security')
-rw-r--r--etc/security48
1 files changed, 37 insertions, 11 deletions
diff --git a/etc/security b/etc/security
index 2db52e9d0ef..d062d892999 100644
--- a/etc/security
+++ b/etc/security
@@ -1,6 +1,6 @@
#!/bin/sh -
#
-# $NetBSD: security,v 1.99 2006/09/23 04:07:01 jmcneill Exp $
+# $NetBSD: security,v 1.100 2006/09/26 08:32:40 tron Exp $
# from: @(#)security 8.1 (Berkeley) 6/9/93
#
@@ -583,20 +583,46 @@ if checkyesno check_nfs && [ -f /etc/exports ]; then
# ignore comments and blank lines
if ($0 ~ /^\#/ || $0 ~ /^$/ )
next;
+ # manage line continuation
+ while ($NF ~ /^\\$/) {
+ $NF = "";
+ line = $0 "";
+ getline;
+ $0 = line $0 "";
+ }
- readonly = 0;
- for (i = 2; i <= NF; ++i) {
- if ($i ~ /-ro/)
- readonly = 1;
- else if ($i ~ /^-network=/)
- next;
- else if ($i !~ /^-/)
- next;
+ delete dir;
+ readonly = ndir = 0;
+ for (i = 1; i <= NF; ++i) {
+ if ($i ~ /^\//) dir[ndir++] = $i;
+ else if ($i ~ /^-/) {
+ if ($i ~ /^-(ro|o)$/) readonly = 1;
+ if ($i ~ /^-network/) next;
+ }
+ else next;
}
if (readonly)
- print "File system " $1 " globally exported, read-only."
+ for (item in dir)
+ rodir[nrodir++] = dir[item];
else
- print "File system " $1 " globally exported, read-write."
+ for (item in dir)
+ rwdir[nrwdir++] = dir[item];
+
+ }
+
+ END {
+ if (nrodir) {
+ printf("Globally exported file system%s, read-only:\n",
+ nrodir > 1 ? "s" : "");
+ for (item in rodir)
+ printf("\t%s\n", rodir[item]);
+ }
+ if (nrwdir) {
+ printf("Globally exported file system%s, read-write:\n",
+ nrwdir > 1 ? "s" : "");
+ for (item in rwdir)
+ printf("\t%s\n", rwdir[item]);
+ }
}' < /etc/exports > $OUTPUT
if [ -s $OUTPUT ] ; then
printf "\nChecking for globally exported file systems.\n"