Re: libexec/security: don't prune mount points

2020-10-11 Thread Ingo Schwarze
Hi Todd, Todd C. Miller wrote on Wed, Oct 07, 2020 at 09:36:33AM -0600: > The recent changes to the daily security script will result in it > not traversing file systems where the parent mount point is mounted > with options nodev,nosuid but the child is mounted with setuid > enabled. > > For ex

libexec/security: don't prune mount points

2020-10-07 Thread Todd C . Miller
The recent changes to the daily security script will result in it not traversing file systems where the parent mount point is mounted with options nodev,nosuid but the child is mounted with setuid enabled. For example, if /var/www is a separate file system that allows setuid but /var is mounted wi