From f45e18ea6050def6772f9cedd78273be8814cb30 Mon Sep 17 00:00:00 2001
From: "Rodney W. Grimes" <rgrimes@FreeBSD.org>
Date: Mon, 6 Sep 1993 23:12:04 +0000
Subject: [PATCH] Fixed so that it scans for set uid/gid files.  From Rich
 Murphy and NetBSD, plus some tid bits from me.

---
 etc/security | 40 ++++++++++++++++++++++++++++------------
 1 file changed, 28 insertions(+), 12 deletions(-)

diff --git a/etc/security b/etc/security
index 388f4a4e81b..30533acd09a 100644
--- a/etc/security
+++ b/etc/security
@@ -1,6 +1,7 @@
 #!/bin/sh -
 #
 #	@(#)security	5.3 (Berkeley) 5/28/91
+#	$Id$
 #
 PATH=/sbin:/bin:/usr/bin
 
@@ -10,18 +11,34 @@ echo "Subject: $host security check output"
 LOG=/var/log
 TMP=/tmp/_secure.$$
 
-if false; then
+umask 027
+
 echo "checking setuid files and devices:"
-MP=`mount -t ufs | sed 's;/dev/;&r;' | awk '{ print $1 " " $3 }'`
-set $MP
-ls -lgT `while test $# -ge 2; do
-	device=$1
-	shift
-	mount=$1
-	shift
-	ncheck -s $device | sed -e "/:$/d" -e "/\/dev\//d" \
-	    -e "s;[^/]*;$mount;" -e "s;//;/;g" | sort
-done` > $TMP
+
+# don't have ncheck, but this does the equivalent of the commented out block.
+# note that one of the original problem, the possibility of overrunning
+# the args to ls, is still here...
+#
+# add this after -a when find supports isofs, and you don't want to check
+# your cd roms
+#    \( ! \( -fstype isofs \) -o -prune \) \
+# do skip checking cdroms
+
+find / -fstype local -a \
+    \( -perm -u+s -or -perm -g+s \) | \
+	sed -e "/\/dev\//d" -e "s;//;/;g" | sort | xargs -n 20 ls -lgT > $TMP
+
+
+#MP=`mount -t ufs | sed 's;/dev/;&r;' | awk '{ print $1 " " $3 }'`
+#set $MP
+#ls -lgT `while test $# -ge 2; do
+#	device=$1
+#	shift
+#	mount=$1
+#	shift
+#	ncheck -s $device | sed -e "/:$/d" -e "/\/dev\//d" \
+#	    -e "s;[^/]*;$mount;" -e "s;//;/;g" | sort
+#done` > $TMP
 
 if cmp $LOG/setuid.today $TMP >/dev/null; then :; else
 	echo "$host setuid/device diffs:"
@@ -30,7 +47,6 @@ if cmp $LOG/setuid.today $TMP >/dev/null; then :; else
 	mv $TMP $LOG/setuid.today
 fi
 rm -f $TMP
-fi
 
 echo ""
 echo ""