Re: negative group permissions?

On Tue, Feb 28, 2012 at 04:24:47PM +0000, Anton Shterenlikht wrote:
> On Tue, Feb 28, 2012 at 03:07:43PM +0000, jb wrote:
> > Anton Shterenlikht <mexas <at> bristol.ac.uk> writes:
> > 
> > > 
> > > This was discussed in questions_at_ with no resolution.
> > > Anybody here can advise further?
> > > ...
> > 
> > Regarding file .seq or .SEQ
> > 
> > It is an intermediate-processing (run-time) lockfile found in various spool 
> > dirs and their sub-dirs, like
> > /var/spool/cron/
> >           /at,
> >           /lpd, etc.
> > It is used to save job# by the respective programs (cron, at, etc).
> > You can find a ref to .SEQ in file at.c in at port sources.
> > I did not see ref to .seq in lpr or cron port sources.
> > 
> > The periodic security check 
> > /etc/periodic/security/110.neggrpperm
> > checks for risque condition like
> > ! -perm +010 -and -perm +001
> > 
> > The file should not be executable, according to its purpose.
> > 
> > So the lpr.c should be changed from
> > if ((fd = open(buf, O_RDWR|O_CREAT, 0661)) < 0) {
> > to
> > if ((fd = open(buf, O_RDWR|O_CREAT, 0660)) < 0) {
> > 
> > File a bug report.
> 
> http://www.freebsd.org/cgi/query-pr.cgi?pr=kern/165533

The only thing that is wrong here is the misconception of negative
permissions. This bit of code tracks all the way back to 4.3BSD and
probably further while LPR dates back to 3BSD. Nobody programs 661 for no
reason and changing that code will most likely have a negative impact
and I do not see that as a real answer to this problem.

Above I see your .seq file created 0641 so not only do you have a
negative permission on the file you are also missing a bit ;). You might
want to review some of your other permissions to see if anything is
missing. That has been explained all over the net for the differences
of x86 & x86_64 systems.
 
I attempted to search around for the history of 661 on .seq but cannot
find any at the moment. E_LACKINGSLEEP

-- 
;s =;