Re: auditing

Alexander V. Kalganov wrote:
> Hello.
> I've subscribed for /bin and would like to know if someone has already done
> something, so I can start working.

Yes. This is what I've come up with:

(excerpt form an old mail by me)

Okay,

Here's what I've done so far:

done:
cat
chmod
cp
date
echo
expr PATCH
hostname
sleep
pwd
df PATCH
sync

Below the patches. They are not security related but came up during the review ;-). The expr patch is not really necessary but was found 3 months ago when I wanted to use an expr like syntax in a program I wrote. The other one is funny: it breaks df for non-mounted file systems for root, *not* for anyone else ;-)

-Guido

• expr.y.orig Mon Dec 11 23:59:22 1995 +++ expr.y Thu Feb 13 22:27:34 1997 @@ -136,6 +136,7 @@ { if (vp->type == string || vp->type == numeric_string) free (vp->u.s); + free (vp); }

Do you need help?

In addition to our free technical library, Pantek provides professional IT services to companies who utilize Open Source software: Learn more about Pantek's Technical Support offerings Place an order for 24/7/365 Technical Support here Learn more about Pantek, who we are, and what we do Chat with a Live Operator Related audit-dead Links auditors bin contrib eBones games init lib libc libexec lkm sbin secure telnetd usr Request more information about Pantek

@@ -232,6 +233,8 @@
 int argc;
 char **argv;
 {
+ int retval;
+

         setlocale (LC_ALL, "");  

         av = argv + 1;
@@ -243,7 +246,9 @@

 	else
 		printf ("%s\n", result->u.s);
 
-	return (is_zero_or_null (result));
+	retval = is_zero_or_null (result);
+	free_value(result);
+	return (retval);

 int

• df.c.orig Thu Feb 13 22:06:14 1997 +++ df.c Thu Feb 13 21:59:40 1997 @@ -197,7 +197,7 @@ ufs_df(*argv, maxwidth); (void)rmdir(mntpt); continue; - } else if (statfs(mntpt, &statfsbuf)) { + } else if (statfs(mntpt, &statfsbuf) == 0) { statfsbuf.f_mntonname[0] = '\0'; prtstat(&statfsbuf, maxwidth); } else