Re: seccheck: prune directories possible?

Carlos E. R. [01.12.2014 16:06]:
> On 2014-12-01 15:36, Werner Flamme wrote:
>> Carlos E. R. [01.12.2014 15:08]:
> 
> 
>>> So the important thing to look for is that 'MNT'. It is created
>>> this way:
> 
>> Yes, and so on, but I'd like not to modify the scripts themselves,
>> since they are overwritten with every update of the package, even
>> when it's caused by an automatic rebuild, and only the last cipher
>> has increased.
> 
> You can wait months for an update with this modification. Even for
> next release cycle...

Depends. When I use the (newer) version from security repo, I'm in for a
change every few days sometimes.

> You could add a cron job that emails you when the script has been
> replaced or modified, so that you can reconsider edit it back again.
> You can even email yourself the diff, and perhaps just replace with
> your copy. Or automatically undo the changes and store the update in
> quarantine, for your manual consideration. I don't think there are
> many upstream changes, though — at least, not on openSUSE. Maybe SLES
> is different :-?
> 
> I don't see any other immediate solution for that grin ;-)

I try to think about something that will make manual interaction
unneeded, until the changes are very incompatible...

>> [..]
> 
>>> Here it produces:
>>>
>>> /dev/ / /usr /boot /home /home_aux /home1 /opt /data/storage_d 
>>> /data/storage_b /usr/src /usr/local /data/homedvl /data/vmware 
>>> ...
>>>
>>> I wonder about "/dev/" and "/".
> 
>> I sure want security checks in those places :)
> 
> Well, dev yes, but not root, because it is everything, including your
> backup. All the directories on the first level are printed in that
> command output, so "/" is not needed, unless it means just "/", not
> its directories.

If / means everything, why would the script bother to find out about
mountpoints at all?

As you found out, $MNT is used by the "find" command with the option
"-mount", which is explained on my manpage as "Don't descend directories
on other filesystems.". That's why there is a need to discover
mountpoints at all.

Werner

--