upstream/opnsense-src
1
0
Fork 0
mirror of https://github.com/opnsense/src.git synced 2026-06-18 21:20:30 -04:00
Code Issues Projects Releases Packages Wiki Activity Actions
opnsense-src/libexec/rc/rc.d
History
Ian Lepore 1e121c3ef1 Limit access to system accounting files. 
In 2013 the security chapter of the Handbook was updated in r42501 to
suggest limiting access to the system accounting file [*1] by creating the
initial file with a mode of 0600. This was in part based on a discussion in
the forums [*2]. Unfortunately, this advice is overridden by the fact that a
new file is created as part of periodic daily processing, and the file mode
is set by the rc.d/accounting script.

These changes update the accounting script to create the directory with mode
0750 if it doesn't already exist, and to create the daily file with mode
0640. This limits write access to root only, read access to root and members
of wheel, and eliminates world access completely. For admins who want to
prevent even members of wheel from accessing the files, the mode of the
/var/account directory can be manually changed to 0700, because the script
never creates or changes that directory if it already exists.

The accounting_rotate_log() function now also handles the error cases of no
existing log file to rotate, and attempting to rotate the file multiple
times (.0 file already exists).

Another small change here eliminates the complexity of the mktemp/chmod/mv
sequence for creating a new acct file by using install(1) with the flags
needed to directly create the file with the desired ownership and
modes. That allows coalescing two separate if checkyesno accounting_enable
blocks into one.

These changes were inspired by my investigation of PR 202203.

[1] https://www.freebsd.org/doc/handbook/security-accounting.html
[2] http://forums.freebsd.org/showthread.php?t=41059

PR:		202203
Differential Revision:	https://reviews.freebsd.org/D20876
2019-07-13 16:07:38 +00:00
..
abi Revert r346017 pending compiled-in zfs fix 2019-04-10 07:51:13 +00:00
accounting Limit access to system accounting files. 2019-07-13 16:07:38 +00:00
addswap Move the rc framework out of sbin/init into libexec/rc. 2018-10-17 16:49:11 +00:00
adjkerntz Move the rc framework out of sbin/init into libexec/rc. 2018-10-17 16:49:11 +00:00
amd Move the rc framework out of sbin/init into libexec/rc. 2018-10-17 16:49:11 +00:00
apm Move the rc framework out of sbin/init into libexec/rc. 2018-10-17 16:49:11 +00:00
apmd Move the rc framework out of sbin/init into libexec/rc. 2018-10-17 16:49:11 +00:00
archdep Remove iBCS2, part1: userspace 2018-12-19 21:56:54 +00:00
auditd Move the rc framework out of sbin/init into libexec/rc. 2018-10-17 16:49:11 +00:00
auditdistd Move the rc framework out of sbin/init into libexec/rc. 2018-10-17 16:49:11 +00:00
automount Move the rc framework out of sbin/init into libexec/rc. 2018-10-17 16:49:11 +00:00
automountd Move the rc framework out of sbin/init into libexec/rc. 2018-10-17 16:49:11 +00:00
autounmountd Move the rc framework out of sbin/init into libexec/rc. 2018-10-17 16:49:11 +00:00
bgfsck Move the rc framework out of sbin/init into libexec/rc. 2018-10-17 16:49:11 +00:00
blacklistd Move the rc framework out of sbin/init into libexec/rc. 2018-10-17 16:49:11 +00:00
bluetooth Move the rc framework out of sbin/init into libexec/rc. 2018-10-17 16:49:11 +00:00
bootparams Move the rc framework out of sbin/init into libexec/rc. 2018-10-17 16:49:11 +00:00
bridge Move the rc framework out of sbin/init into libexec/rc. 2018-10-17 16:49:11 +00:00
bsnmpd Move the rc framework out of sbin/init into libexec/rc. 2018-10-17 16:49:11 +00:00
bthidd Revert r346017 pending compiled-in zfs fix 2019-04-10 07:51:13 +00:00
ccd Move the rc framework out of sbin/init into libexec/rc. 2018-10-17 16:49:11 +00:00
cfumass Revert r346017 pending compiled-in zfs fix 2019-04-10 07:51:13 +00:00
cleanvar Move the rc framework out of sbin/init into libexec/rc. 2018-10-17 16:49:11 +00:00
cleartmp Move the rc framework out of sbin/init into libexec/rc. 2018-10-17 16:49:11 +00:00
cron Move the rc framework out of sbin/init into libexec/rc. 2018-10-17 16:49:11 +00:00
ctld Move the rc framework out of sbin/init into libexec/rc. 2018-10-17 16:49:11 +00:00
DAEMON Move the rc framework out of sbin/init into libexec/rc. 2018-10-17 16:49:11 +00:00
ddb Move the rc framework out of sbin/init into libexec/rc. 2018-10-17 16:49:11 +00:00
defaultroute Move the rc framework out of sbin/init into libexec/rc. 2018-10-17 16:49:11 +00:00
devd Move the rc framework out of sbin/init into libexec/rc. 2018-10-17 16:49:11 +00:00
devfs Move the rc framework out of sbin/init into libexec/rc. 2018-10-17 16:49:11 +00:00
devmatch Move the rc framework out of sbin/init into libexec/rc. 2018-10-17 16:49:11 +00:00
dhclient Move the rc framework out of sbin/init into libexec/rc. 2018-10-17 16:49:11 +00:00
dmesg Move the rc framework out of sbin/init into libexec/rc. 2018-10-17 16:49:11 +00:00
dumpon Move the rc framework out of sbin/init into libexec/rc. 2018-10-17 16:49:11 +00:00
FILESYSTEMS Move the rc framework out of sbin/init into libexec/rc. 2018-10-17 16:49:11 +00:00
fsck Move the rc framework out of sbin/init into libexec/rc. 2018-10-17 16:49:11 +00:00
ftp-proxy Move the rc framework out of sbin/init into libexec/rc. 2018-10-17 16:49:11 +00:00
ftpd Move the rc framework out of sbin/init into libexec/rc. 2018-10-17 16:49:11 +00:00
gbde Move the rc framework out of sbin/init into libexec/rc. 2018-10-17 16:49:11 +00:00
geli Move the rc framework out of sbin/init into libexec/rc. 2018-10-17 16:49:11 +00:00
geli2 Move the rc framework out of sbin/init into libexec/rc. 2018-10-17 16:49:11 +00:00
gptboot Move the rc framework out of sbin/init into libexec/rc. 2018-10-17 16:49:11 +00:00
growfs Remove an unneeded 'tail -n 1' from a pipeline 2019-03-11 13:33:03 +00:00
gssd Move the rc framework out of sbin/init into libexec/rc. 2018-10-17 16:49:11 +00:00
hastd Move the rc framework out of sbin/init into libexec/rc. 2018-10-17 16:49:11 +00:00
hcsecd Move the rc framework out of sbin/init into libexec/rc. 2018-10-17 16:49:11 +00:00
hostapd Allow the hostapd program to be specified. This allows users to use 2019-06-17 20:11:02 +00:00
hostid Move the rc framework out of sbin/init into libexec/rc. 2018-10-17 16:49:11 +00:00
hostid_save Move the rc framework out of sbin/init into libexec/rc. 2018-10-17 16:49:11 +00:00
hostname Move the rc framework out of sbin/init into libexec/rc. 2018-10-17 16:49:11 +00:00
inetd Move the rc framework out of sbin/init into libexec/rc. 2018-10-17 16:49:11 +00:00
iovctl Move the rc framework out of sbin/init into libexec/rc. 2018-10-17 16:49:11 +00:00
ip6addrctl Move the rc framework out of sbin/init into libexec/rc. 2018-10-17 16:49:11 +00:00
ipfilter Move the rc framework out of sbin/init into libexec/rc. 2018-10-17 16:49:11 +00:00
ipfs Move the rc framework out of sbin/init into libexec/rc. 2018-10-17 16:49:11 +00:00
ipfw Add ability to automatically load ipfw_nat64, ipfw_nptv6 and ipfw_pmod 2019-03-23 15:41:32 +00:00
ipfw_netflow Move the rc framework out of sbin/init into libexec/rc. 2018-10-17 16:49:11 +00:00
ipmon Allow forced start of ipmon in special cases where testing is desired 2018-11-22 04:48:27 +00:00
ipnat Move the rc framework out of sbin/init into libexec/rc. 2018-10-17 16:49:11 +00:00
ippool The check for $ippool_rules in start_cmd is tautological. 2019-03-23 04:32:10 +00:00
ipropd_master Move the rc framework out of sbin/init into libexec/rc. 2018-10-17 16:49:11 +00:00
ipropd_slave Move the rc framework out of sbin/init into libexec/rc. 2018-10-17 16:49:11 +00:00
ipsec Add ipsec.ko to required_modules for rc.d/ipsec script. 2019-05-06 08:30:53 +00:00
iscsictl Move the rc framework out of sbin/init into libexec/rc. 2018-10-17 16:49:11 +00:00
iscsid Move the rc framework out of sbin/init into libexec/rc. 2018-10-17 16:49:11 +00:00
jail Move definition of $jail_conf variable to /etc/defaults/rc.conf 2018-11-10 14:11:54 +00:00
kadmind Move the rc framework out of sbin/init into libexec/rc. 2018-10-17 16:49:11 +00:00
kdc Move the rc framework out of sbin/init into libexec/rc. 2018-10-17 16:49:11 +00:00
keyserv Move the rc framework out of sbin/init into libexec/rc. 2018-10-17 16:49:11 +00:00
kfd Move the rc framework out of sbin/init into libexec/rc. 2018-10-17 16:49:11 +00:00
kld Revert r346017 pending compiled-in zfs fix 2019-04-10 07:51:13 +00:00
kldxref Move the rc framework out of sbin/init into libexec/rc. 2018-10-17 16:49:11 +00:00
kpasswdd Move the rc framework out of sbin/init into libexec/rc. 2018-10-17 16:49:11 +00:00
ldconfig Move the rc framework out of sbin/init into libexec/rc. 2018-10-17 16:49:11 +00:00
local /etc/rc.d/local: Fix typo in description 2019-06-10 13:34:18 +00:00
local_unbound Run unbound-anchor when root.key is empty, not just when it is absent. 2018-11-01 14:24:12 +00:00
localpkg Move the rc framework out of sbin/init into libexec/rc. 2018-10-17 16:49:11 +00:00
lockd Move the rc framework out of sbin/init into libexec/rc. 2018-10-17 16:49:11 +00:00
LOGIN Move the rc framework out of sbin/init into libexec/rc. 2018-10-17 16:49:11 +00:00
lpd Move the rc framework out of sbin/init into libexec/rc. 2018-10-17 16:49:11 +00:00
Makefile pkgbase: Remove etc/zfs from being packaged 2019-05-23 06:53:59 +00:00
mdconfig Revert r346017 pending compiled-in zfs fix 2019-04-10 07:51:13 +00:00
mdconfig2 Revert r346017 pending compiled-in zfs fix 2019-04-10 07:51:13 +00:00
mixer Move the rc framework out of sbin/init into libexec/rc. 2018-10-17 16:49:11 +00:00
motd rc.d/motd: Update motd more robustly 2019-06-21 02:37:54 +00:00
mountcritlocal Move the rc framework out of sbin/init into libexec/rc. 2018-10-17 16:49:11 +00:00
mountcritremote Revert r346017 pending compiled-in zfs fix 2019-04-10 07:51:13 +00:00
mountd Move the rc framework out of sbin/init into libexec/rc. 2018-10-17 16:49:11 +00:00
mountlate Move the rc framework out of sbin/init into libexec/rc. 2018-10-17 16:49:11 +00:00
moused Move the rc framework out of sbin/init into libexec/rc. 2018-10-17 16:49:11 +00:00
msgs Move the rc framework out of sbin/init into libexec/rc. 2018-10-17 16:49:11 +00:00
natd Move the rc framework out of sbin/init into libexec/rc. 2018-10-17 16:49:11 +00:00
netif Move the rc framework out of sbin/init into libexec/rc. 2018-10-17 16:49:11 +00:00
netoptions Move the rc framework out of sbin/init into libexec/rc. 2018-10-17 16:49:11 +00:00
netwait Move the rc framework out of sbin/init into libexec/rc. 2018-10-17 16:49:11 +00:00
NETWORKING Move the rc framework out of sbin/init into libexec/rc. 2018-10-17 16:49:11 +00:00
newsyslog Move the rc framework out of sbin/init into libexec/rc. 2018-10-17 16:49:11 +00:00
nfscbd Move the rc framework out of sbin/init into libexec/rc. 2018-10-17 16:49:11 +00:00
nfsclient Move the rc framework out of sbin/init into libexec/rc. 2018-10-17 16:49:11 +00:00
nfsd Add support for a virtual hostname to nfsd 2019-02-16 00:15:54 +00:00
nfsuserd Move the rc framework out of sbin/init into libexec/rc. 2018-10-17 16:49:11 +00:00
nisdomain Move the rc framework out of sbin/init into libexec/rc. 2018-10-17 16:49:11 +00:00
nscd Move the rc framework out of sbin/init into libexec/rc. 2018-10-17 16:49:11 +00:00
nsswitch Move the rc framework out of sbin/init into libexec/rc. 2018-10-17 16:49:11 +00:00
ntpd Remove accidentally-added blank line; the style throughout this file 2019-05-23 01:49:08 +00:00
ntpdate Move the rc framework out of sbin/init into libexec/rc. 2018-10-17 16:49:11 +00:00
opensm Move the rc framework out of sbin/init into libexec/rc. 2018-10-17 16:49:11 +00:00
othermta Move the rc framework out of sbin/init into libexec/rc. 2018-10-17 16:49:11 +00:00
pf Move the rc framework out of sbin/init into libexec/rc. 2018-10-17 16:49:11 +00:00
pflog Move the rc framework out of sbin/init into libexec/rc. 2018-10-17 16:49:11 +00:00
pfsync Move the rc framework out of sbin/init into libexec/rc. 2018-10-17 16:49:11 +00:00
power_profile Move the rc framework out of sbin/init into libexec/rc. 2018-10-17 16:49:11 +00:00
powerd Move the rc framework out of sbin/init into libexec/rc. 2018-10-17 16:49:11 +00:00
ppp Move the rc framework out of sbin/init into libexec/rc. 2018-10-17 16:49:11 +00:00
pppoed Move the rc framework out of sbin/init into libexec/rc. 2018-10-17 16:49:11 +00:00
pwcheck Move the rc framework out of sbin/init into libexec/rc. 2018-10-17 16:49:11 +00:00
quota Move the rc framework out of sbin/init into libexec/rc. 2018-10-17 16:49:11 +00:00
random save-entropy(8), rc.d/random: Set nodump flag 2019-05-22 21:47:17 +00:00
rarpd Move the rc framework out of sbin/init into libexec/rc. 2018-10-17 16:49:11 +00:00
rctl Move the rc framework out of sbin/init into libexec/rc. 2018-10-17 16:49:11 +00:00
resolv Move the rc framework out of sbin/init into libexec/rc. 2018-10-17 16:49:11 +00:00
rfcomm_pppd_server Move the rc framework out of sbin/init into libexec/rc. 2018-10-17 16:49:11 +00:00
root Move the rc framework out of sbin/init into libexec/rc. 2018-10-17 16:49:11 +00:00
route6d Move the rc framework out of sbin/init into libexec/rc. 2018-10-17 16:49:11 +00:00
routed Move the rc framework out of sbin/init into libexec/rc. 2018-10-17 16:49:11 +00:00
routing Move the rc framework out of sbin/init into libexec/rc. 2018-10-17 16:49:11 +00:00
rpcbind Move the rc framework out of sbin/init into libexec/rc. 2018-10-17 16:49:11 +00:00
rtadvd Move the rc framework out of sbin/init into libexec/rc. 2018-10-17 16:49:11 +00:00
rtsold Move the rc framework out of sbin/init into libexec/rc. 2018-10-17 16:49:11 +00:00
rwho Move the rc framework out of sbin/init into libexec/rc. 2018-10-17 16:49:11 +00:00
savecore Move the rc framework out of sbin/init into libexec/rc. 2018-10-17 16:49:11 +00:00
sdpd Move the rc framework out of sbin/init into libexec/rc. 2018-10-17 16:49:11 +00:00
securelevel Move the rc framework out of sbin/init into libexec/rc. 2018-10-17 16:49:11 +00:00
sendmail Move the rc framework out of sbin/init into libexec/rc. 2018-10-17 16:49:11 +00:00
serial Move the rc framework out of sbin/init into libexec/rc. 2018-10-17 16:49:11 +00:00
SERVERS Move the rc framework out of sbin/init into libexec/rc. 2018-10-17 16:49:11 +00:00
sppp Move the rc framework out of sbin/init into libexec/rc. 2018-10-17 16:49:11 +00:00
sshd Move the rc framework out of sbin/init into libexec/rc. 2018-10-17 16:49:11 +00:00
statd Move the rc framework out of sbin/init into libexec/rc. 2018-10-17 16:49:11 +00:00
static_arp Move the rc framework out of sbin/init into libexec/rc. 2018-10-17 16:49:11 +00:00
static_ndp Move the rc framework out of sbin/init into libexec/rc. 2018-10-17 16:49:11 +00:00
stf Move the rc framework out of sbin/init into libexec/rc. 2018-10-17 16:49:11 +00:00
swap Move the rc framework out of sbin/init into libexec/rc. 2018-10-17 16:49:11 +00:00
swaplate Move the rc framework out of sbin/init into libexec/rc. 2018-10-17 16:49:11 +00:00
syscons Revert r346017 pending compiled-in zfs fix 2019-04-10 07:51:13 +00:00
sysctl Move the rc framework out of sbin/init into libexec/rc. 2018-10-17 16:49:11 +00:00
syslogd Move the rc framework out of sbin/init into libexec/rc. 2018-10-17 16:49:11 +00:00
tmp Move the rc framework out of sbin/init into libexec/rc. 2018-10-17 16:49:11 +00:00
ubthidhci Move the rc framework out of sbin/init into libexec/rc. 2018-10-17 16:49:11 +00:00
ugidfw Move the rc framework out of sbin/init into libexec/rc. 2018-10-17 16:49:11 +00:00
utx Move the rc framework out of sbin/init into libexec/rc. 2018-10-17 16:49:11 +00:00
var Move the rc framework out of sbin/init into libexec/rc. 2018-10-17 16:49:11 +00:00
virecover Move the rc framework out of sbin/init into libexec/rc. 2018-10-17 16:49:11 +00:00
watchdogd Move the rc framework out of sbin/init into libexec/rc. 2018-10-17 16:49:11 +00:00
wpa_supplicant Move the rc framework out of sbin/init into libexec/rc. 2018-10-17 16:49:11 +00:00
ypbind Move the rc framework out of sbin/init into libexec/rc. 2018-10-17 16:49:11 +00:00
ypldap Move the rc framework out of sbin/init into libexec/rc. 2018-10-17 16:49:11 +00:00
yppasswdd Move the rc framework out of sbin/init into libexec/rc. 2018-10-17 16:49:11 +00:00
ypserv Move the rc framework out of sbin/init into libexec/rc. 2018-10-17 16:49:11 +00:00
ypset Move the rc framework out of sbin/init into libexec/rc. 2018-10-17 16:49:11 +00:00
ypupdated Move the rc framework out of sbin/init into libexec/rc. 2018-10-17 16:49:11 +00:00
ypxfrd Move the rc framework out of sbin/init into libexec/rc. 2018-10-17 16:49:11 +00:00
zfs Move the rc framework out of sbin/init into libexec/rc. 2018-10-17 16:49:11 +00:00
zfsbe Move the rc framework out of sbin/init into libexec/rc. 2018-10-17 16:49:11 +00:00
zfsd Move the rc framework out of sbin/init into libexec/rc. 2018-10-17 16:49:11 +00:00
zvol Move the rc framework out of sbin/init into libexec/rc. 2018-10-17 16:49:11 +00:00