On Thu, Aug 31, 2006 at 10:19:24AM -0400, Kris Kennaway wrote: > On Thu, Aug 31, 2006 at 06:15:18PM +0400, Andrew Pantyukhin wrote: > > Under no circumstances should a port install world-writable > > files or directories. In most cases this opens the system to all > > kinds of attacks. A simple grep brings the following list of > > makefiles to attention. I imagine that samba ports are > > somehow justified, as for the other ones, I hope secteam and > > committers will do something about them. > > The install process will warn about this (as well as group writable), > so you can also grep for the warning message in the pointyhat logs.
Here's the list of world-writable from the last i386 6.x build: ./xphotohunter-1.4_2.log.bz2: This port has installed the following world-writable files/directories. ./xphotohunter-1.4_2.log.bz2-/usr/X11R6/share/xphotohunter/xphotohunter.dat ./xphotohunter-1.4_2.log.bz2- -- ./xrally-1.1.1_2.log.bz2: This port has installed the following world-writable files/directories. ./xrally-1.1.1_2.log.bz2-/usr/local/share/xrally/hiscore ./xrally-1.1.1_2.log.bz2- -- ./childsplay-0.80.2_1.log.bz2: This port has installed the following world-writable files/directories. ./childsplay-0.80.2_1.log.bz2-/var/games/childsplay.score ./childsplay-0.80.2_1.log.bz2- -- ./dislin-9.0_2.log.bz2: This port has installed the following world-writable files/directories. ./dislin-9.0_2.log.bz2-/usr/local/dislin/dislin.log ./dislin-9.0_2.log.bz2- -- ./fr-facturier-2.1.2.log.bz2: This port has installed the following world-writable files/directories. ./fr-facturier-2.1.2.log.bz2-/usr/local/www/facturier/log/debug1.txt ./fr-facturier-2.1.2.log.bz2-/usr/local/www/facturier/log/debug.txt ./fr-facturier-2.1.2.log.bz2- -- ./admuser-2.3.1_2.log.bz2: This port has installed the following world-writable files/directories. ./admuser-2.3.1_2.log.bz2-/usr/local/etc/admuser/admuser.log ./admuser-2.3.1_2.log.bz2- -- ./tornado-1.3_1.log.bz2: This port has installed the following world-writable files/directories. ./tornado-1.3_1.log.bz2-/usr/local/share/games/tornado.scores ./tornado-1.3_1.log.bz2- -- ./atris-1.0.7.log.bz2: This port has installed the following world-writable files/directories. ./atris-1.0.7.log.bz2-/usr/local/share/atris/Atris.Players ./atris-1.0.7.log.bz2-/usr/local/share/atris/Atris.Scores ./atris-1.0.7.log.bz2- -- ./pips900-2.1.2_2.log.bz2: This port has installed the following world-writable files/directories. ./pips900-2.1.2_2.log.bz2-/usr/local/etc/pipsrc ./pips900-2.1.2_2.log.bz2- -- ./pips880-2.1.2_2.log.bz2: This port has installed the following world-writable files/directories. ./pips880-2.1.2_2.log.bz2-/usr/local/etc/pipsrc ./pips880-2.1.2_2.log.bz2- -- ./pips-scx3500_3600s-2.6.2_1.log.bz2: This port has installed the following world-writable files/directories. ./pips-scx3500_3600s-2.6.2_1.log.bz2-/usr/local/etc/pipsrc ./pips-scx3500_3600s-2.6.2_1.log.bz2- -- ./pips-sc65_66s-2.6.2_2.log.bz2: This port has installed the following world-writable files/directories. ./pips-sc65_66s-2.6.2_2.log.bz2-/usr/local/etc/pipsrc ./pips-sc65_66s-2.6.2_2.log.bz2- -- ./pips-sp2100_2200-2.6.2_2.log.bz2: This port has installed the following world-writable files/directories. ./pips-sp2100_2200-2.6.2_2.log.bz2-/usr/local/etc/pipsrc ./pips-sp2100_2200-2.6.2_2.log.bz2- -- ./pips-spr200_210-2.6.2_2.log.bz2: This port has installed the following world-writable files/directories. ./pips-spr200_210-2.6.2_2.log.bz2-/usr/local/etc/pipsrc ./pips-spr200_210-2.6.2_2.log.bz2- -- ./pips-sc84_83s-2.6.2_2.log.bz2: This port has installed the following world-writable files/directories. ./pips-sc84_83s-2.6.2_2.log.bz2-/usr/local/etc/pipsrc ./pips-sc84_83s-2.6.2_2.log.bz2- -- ./pipsg700-2.6.2_3.log.bz2: This port has installed the following world-writable files/directories. ./pipsg700-2.6.2_3.log.bz2-/usr/local/etc/pipsrc ./pipsg700-2.6.2_3.log.bz2- -- ./pips980-2.6.2_2.log.bz2: This port has installed the following world-writable files/directories. ./pips980-2.6.2_2.log.bz2-/usr/local/etc/pipsrc ./pips980-2.6.2_2.log.bz2- -- ./pipsv600-2.6.2_2.log.bz2: This port has installed the following world-writable files/directories. ./pipsv600-2.6.2_2.log.bz2-/usr/local/etc/pipsrc ./pipsv600-2.6.2_2.log.bz2- -- ./pips940-2.6.2_2.log.bz2: This port has installed the following world-writable files/directories. ./pips940-2.6.2_2.log.bz2-/usr/local/etc/pipsrc ./pips940-2.6.2_2.log.bz2- -- ./pipsg800-2.6.2_2.log.bz2: This port has installed the following world-writable files/directories. ./pipsg800-2.6.2_2.log.bz2-/usr/local/etc/pipsrc ./pipsg800-2.6.2_2.log.bz2- -- ./xgalaga-2.0.34_1.log.bz2: This port has installed the following world-writable files/directories. ./xgalaga-2.0.34_1.log.bz2-/usr/X11R6/lib/X11/xgalaga/scores ./xgalaga-2.0.34_1.log.bz2- -- ./xpuzzletama-1.5b.log.bz2: This port has installed the following world-writable files/directories. ./xpuzzletama-1.5b.log.bz2-/usr/X11R6/lib/X11/xpuzzletama/tama_score ./xpuzzletama-1.5b.log.bz2- -- ./pips-sc85_86s-2.6.2_2.log.bz2: This port has installed the following world-writable files/directories. ./pips-sc85_86s-2.6.2_2.log.bz2-/usr/local/etc/pipsrc ./pips-sc85_86s-2.6.2_2.log.bz2- -- ./pipsv500-2.6.2_2.log.bz2: This port has installed the following world-writable files/directories. ./pipsv500-2.6.2_2.log.bz2-/usr/local/etc/pipsrc ./pipsv500-2.6.2_2.log.bz2- -- ./spacearyarya-1.0.2_1.log.bz2: This port has installed the following world-writable files/directories. ./spacearyarya-1.0.2_1.log.bz2-/usr/X11R6/share/SpaceAryarya/data/.score ./spacearyarya-1.0.2_1.log.bz2- -- ./pipsg900-2.6.2_2.log.bz2: This port has installed the following world-writable files/directories. ./pipsg900-2.6.2_2.log.bz2-/usr/local/etc/pipsrc ./pipsg900-2.6.2_2.log.bz2- -- ./pips-spr300_310-2.6.2_2.log.bz2: This port has installed the following world-writable files/directories. ./pips-spr300_310-2.6.2_2.log.bz2-/usr/local/etc/pipsrc ./pips-spr300_310-2.6.2_2.log.bz2- -- ./xsok-1.02.log.bz2: This port has installed the following world-writable files/directories. ./xsok-1.02.log.bz2-/usr/X11R6/lib/X11/xsok/Sokoban.score ./xsok-1.02.log.bz2-/usr/X11R6/lib/X11/xsok/Xsok.score ./xsok-1.02.log.bz2-/usr/X11R6/lib/X11/xsok/Cyberbox.score ./xsok-1.02.log.bz2- -- ./xgs-0.50_1.log.bz2: This port has installed the following world-writable files/directories. ./xgs-0.50_1.log.bz2-/usr/local/share/xgs/xgs.ram ./xgs-0.50_1.log.bz2- -- ./xmines-1.0.log.bz2: This port has installed the following world-writable files/directories. ./xmines-1.0.log.bz2-/usr/X11R6/share/xmines/scores ./xmines-1.0.log.bz2- -- ./glest-data-2.0.0.log.bz2: This port has installed the following world-writable files/directories. ./glest-data-2.0.0.log.bz2-/usr/X11R6/lib/glest/glest.log ./glest-data-2.0.0.log.bz2- -- ./xwelltris-1.0.1.log.bz2: This port has installed the following world-writable files/directories. ./xwelltris-1.0.1.log.bz2-/usr/local/share/xwelltris/welltris.scores ./xwelltris-1.0.1.log.bz2- -- ./pips4000-2.6.2_2.log.bz2: This port has installed the following world-writable files/directories. ./pips4000-2.6.2_2.log.bz2-/usr/local/etc/pipsrc ./pips4000-2.6.2_2.log.bz2- -- ./pips780-2.1.2_2.log.bz2: This port has installed the following world-writable files/directories. ./pips780-2.1.2_2.log.bz2-/usr/local/etc/pipsrc ./pips780-2.1.2_2.log.bz2- -- ./pips820-1.3.2_2.log.bz2: This port has installed the following world-writable files/directories. ./pips820-1.3.2_2.log.bz2-/usr/local/etc/pipsrc ./pips820-1.3.2_2.log.bz2- -- ./pipsv700-2.6.2_2.log.bz2: This port has installed the following world-writable files/directories. ./pipsv700-2.6.2_2.log.bz2-/usr/local/etc/pipsrc ./pipsv700-2.6.2_2.log.bz2- -- ./grande-0.6_2.log.bz2: This port has installed the following world-writable files/directories. ./grande-0.6_2.log.bz2-/usr/X11R6/share/grande/score/grande.scores ./grande-0.6_2.log.bz2- -- ./pips-sc60s-2.5.2_2.log.bz2: This port has installed the following world-writable files/directories. ./pips-sc60s-2.5.2_2.log.bz2-/usr/local/etc/pipsrc ./pips-sc60s-2.5.2_2.log.bz2- -- ./pips800-1.3.2_2.log.bz2: This port has installed the following world-writable files/directories. ./pips800-1.3.2_2.log.bz2-/usr/local/etc/pipsrc ./pips800-1.3.2_2.log.bz2- -- ./xbill-2.1_2.log.bz2: This port has installed the following world-writable files/directories. ./xbill-2.1_2.log.bz2-/usr/X11R6/share/xbill/scores/xbill/scores ./xbill-2.1_2.log.bz2- -- ./pips-sc80s-2.5.2_1.log.bz2: This port has installed the following world-writable files/directories. ./pips-sc80s-2.5.2_1.log.bz2-/usr/local/etc/pipsrc ./pips-sc80s-2.5.2_1.log.bz2- -- ./pips760-1.3.2_2.log.bz2: This port has installed the following world-writable files/directories. ./pips760-1.3.2_2.log.bz2-/usr/local/etc/pipsrc ./pips760-1.3.2_2.log.bz2- -- ./pips730-2.5.2_2.log.bz2: This port has installed the following world-writable files/directories. ./pips730-2.5.2_2.log.bz2-/usr/local/etc/pipsrc ./pips730-2.5.2_2.log.bz2- -- ./pips870-2.6.2_2.log.bz2: This port has installed the following world-writable files/directories. ./pips870-2.6.2_2.log.bz2-/usr/local/etc/pipsrc ./pips870-2.6.2_2.log.bz2- -- ./pips3300-1.3.2_2.log.bz2: This port has installed the following world-writable files/directories. ./pips3300-1.3.2_2.log.bz2-/usr/local/etc/pipsrc ./pips3300-1.3.2_2.log.bz2- -- ./pips3500-2.1.2_2.log.bz2: This port has installed the following world-writable files/directories. ./pips3500-2.1.2_2.log.bz2-/usr/local/etc/pipsrc ./pips3500-2.1.2_2.log.bz2- -- ./pips930-2.6.2_1.log.bz2: This port has installed the following world-writable files/directories. ./pips930-2.6.2_1.log.bz2-/usr/local/etc/pipsrc ./pips930-2.6.2_1.log.bz2- -- ./pips970-2.6.2_2.log.bz2: This port has installed the following world-writable files/directories. ./pips970-2.6.2_2.log.bz2-/usr/local/etc/pipsrc ./pips970-2.6.2_2.log.bz2- -- ./pips750_2000-1.3.2_2.log.bz2: This port has installed the following world-writable files/directories. ./pips750_2000-1.3.2_2.log.bz2-/usr/local/etc/pipsrc ./pips750_2000-1.3.2_2.log.bz2- -- ./columns-1.2b_1.log.bz2: This port has installed the following world-writable files/directories. ./columns-1.2b_1.log.bz2-/usr/X11R6/share/Columns/columns.hsc ./columns-1.2b_1.log.bz2- -- ./pcemu-1.01b_1.log.bz2: This port has installed the following world-writable files/directories. ./pcemu-1.01b_1.log.bz2-/usr/local/lib/pcemu/DriveA ./pcemu-1.01b_1.log.bz2- -- ./xjewel-1.6.log.bz2: This port has installed the following world-writable files/directories. ./xjewel-1.6.log.bz2-/usr/X11R6/lib/X11/xjewel/xjewel.scores ./xjewel-1.6.log.bz2- -- ./geki2-2.0.3.log.bz2: This port has installed the following world-writable files/directories. ./geki2-2.0.3.log.bz2-/usr/local/share/geki2/data/.score ./geki2-2.0.3.log.bz2- -- ./AutoIndex-2.2.0.log.bz2: This port has installed the following world-writable files/directories. ./AutoIndex-2.2.0.log.bz2-/usr/local/www/data/AutoIndex/config.php ./AutoIndex-2.2.0.log.bz2- -- ./geki3-1.0.3.log.bz2: This port has installed the following world-writable files/directories. ./geki3-1.0.3.log.bz2-/usr/local/share/geki3/data/.score ./geki3-1.0.3.log.bz2- -- ./oilwar-1.2.1_3.log.bz2: This port has installed the following world-writable files/directories. ./oilwar-1.2.1_3.log.bz2-/usr/local/share/oilwar/oilwar.scores ./oilwar-1.2.1_3.log.bz2- -- ./linux_base-gentoo-stage3-2006.0_1.log.bz2: This port has installed the following world-writable files/directories. ./linux_base-gentoo-stage3-2006.0_1.log.bz2-/compat/linux/lib/udev/devices/null ./linux_base-gentoo-stage3-2006.0_1.log.bz2-/compat/linux/lib/udev/devices/zero ./linux_base-gentoo-stage3-2006.0_1.log.bz2- -- ./linux_dist-gentoo-stage3-2006.0_1.log.bz2: This port has installed the following world-writable files/directories. ./linux_dist-gentoo-stage3-2006.0_1.log.bz2-/usr/local/gentoo-stage3/lib/udev/devices/null ./linux_dist-gentoo-stage3-2006.0_1.log.bz2-/usr/local/gentoo-stage3/lib/udev/devices/zero ./linux_dist-gentoo-stage3-2006.0_1.log.bz2- -- ./pips670-1.3.2_2.log.bz2: This port has installed the following world-writable files/directories. ./pips670-1.3.2_2.log.bz2-/usr/local/etc/pipsrc ./pips670-1.3.2_2.log.bz2- -- ./pips770-1.3.2_2.log.bz2: This port has installed the following world-writable files/directories. ./pips770-1.3.2_2.log.bz2-/usr/local/etc/pipsrc ./pips770-1.3.2_2.log.bz2- -- ./phpGedView-3.2.1_1.log.bz2: This port has installed the following world-writable files/directories. ./phpGedView-3.2.1_1.log.bz2-/usr/local/www/data/phpGedView/config_download.php-dist ./phpGedView-3.2.1_1.log.bz2-/usr/local/www/data/phpGedView/config_gedcom.php-dist ./phpGedView-3.2.1_1.log.bz2-/usr/local/www/data/phpGedView/authentication_mysql.php-dist ./phpGedView-3.2.1_1.log.bz2-/usr/local/www/data/phpGedView/authentication_index.php-dist ./phpGedView-3.2.1_1.log.bz2-/usr/local/www/data/phpGedView/config.php-dist -- ./pips2200-1.3.2_2.log.bz2: This port has installed the following world-writable files/directories. ./pips2200-1.3.2_2.log.bz2-/usr/local/etc/pipsrc ./pips2200-1.3.2_2.log.bz2- -- ./pips740-2.6.2_2.log.bz2: This port has installed the following world-writable files/directories. ./pips740-2.6.2_2.log.bz2-/usr/local/etc/pipsrc ./pips740-2.6.2_2.log.bz2- -- ./inform-6.30.log.bz2: This port has installed the following world-writable files/directories. ./inform-6.30.log.bz2-/usr/local/share/doc/inform/readme.txt ./inform-6.30.log.bz2- -- ./pips3000-1.3.2_2.log.bz2: This port has installed the following world-writable files/directories. ./pips3000-1.3.2_2.log.bz2-/usr/local/etc/pipsrc ./pips3000-1.3.2_2.log.bz2- -- ./fr-gibi-2003.2.log.bz2: This port has installed the following world-writable files/directories. ./fr-gibi-2003.2.log.bz2-/usr/local/apps/gibi/USRDAT ./fr-gibi-2003.2.log.bz2- -- ./pips-spr800-2.6.2_2.log.bz2: This port has installed the following world-writable files/directories. ./pips-spr800-2.6.2_2.log.bz2-/usr/local/etc/pipsrc ./pips-spr800-2.6.2_2.log.bz2- Kris
pgpYyiqAfx4kN.pgp
Description: PGP signature
