wireguard-openbsd/libexec/security, branch master

Don't skip file systems just because the parent fs is nodev and nosuid.

2020-10-11T18:28:17Z

Fixes instances where a mount point uses the nodev and nosuid options but another file system mounted inside that hierarchy does not. OK schwarze@

afs, nnpfs, and procfs are no longer supported,

2020-09-17T06:51:06Z

so stop looking for them in mount(8) output; no functional change intended; OK millert@

Do not bother scanning file systems that are both nodev and nosuid

2020-09-14T14:43:13Z

for SUID, SGID, and device files, implementing an idea that deraadt@ came up with based on a somewhat similar idea from millert@ after a loosely related comment from Rupert Gallagher on misc@. While here, minimally simplify the way mount options are parsed, hoping to make the parsing more readable and also more robust. OK millert@ deraadt@

Remove user uucp and group news from base.

2016-12-27T09:17:52Z

When checking ownership and modes of files in /var/mail/,

2016-10-22T18:35:12Z

ignore *.lock files, to avoid pointless warning mails reported by Philippe Meunier ; OK florian@ jca@

When reading untrusted user files, don't risk blocking, such that

2015-07-21T19:07:13Z

users can't mount a DOS attack against security(8), and for additional safety against race attacks, make sure they are regular files after opening and before actually reading them. Issue originally hinted at by Sevan Janiyan based on a NetBSD commit message, then commented on by tedu@, problem finally confirmed by guenther@, who also provided feedback on the actual patch.

When diff(1) finds differences, it returns an exit status of 1.

2015-04-21T10:24:22Z

In that particular case, refrain from printing "diff: exit code 1" because that exit status doesn't indicate an error condition. Issue noticed by and patch OK'ed by ajacoutot@. "I agree with the goal, and I suspect the diff actually achieves it" guenther@.

In mount(8) output, do not misparse lines where fs_spec ends with the

2015-03-27T13:26:19Z

two characters "on", which can for example happen for NFS mounts. Patch from Lauri Tirkkonen on bugs@.

If /etc/passwd contains incomplete lines ending before the

2015-03-27T12:33:36Z

home directory field, warn explicitly rather than stumbling into Perl "uninitialized value" warnings. Issue reported by Denis Lapshin . OK afresh1@

AnonCVS is designed to work with a user account that has no password and a

2014-12-04T00:07:21Z

very special shell, so do not complain about that particular combination. Idea originally brought up by landry@ five years ago, repeatedly forgotten. Using feedback from sthen@ millert@ halex@; OK landry@ ajacoutot@.