[patch] mtree(8) inode number tracking support
ryan beasley <[email protected]>
| Newsgroups | gmane.os.freebsd.devel.audit |
|---|---|
| Message-ID | <[email protected]> |
Hi!
The following patch adds support for tracking inode number changes
to mtree(8). It seems like a good idea for those using mtree as the
poor-man's Tripwire. (Forgot who coined that phrase. :/)
(Patch made against mid-February RELENG_4. Also attached is an
excerpt of a mtree "session" to show output for differing inodes.)
Thoughts?
--
ryan beasley <[email protected]>
professional fat bastard http://www.goddamnbastard.org
GPG ID 0x36321D13
mtree.inode.patch
(text/plain, 2.9 KB)
Common subdirectories: src/usr.sbin/mtree.orig/CVS and src/usr.sbin/mtree/CVS
diff -u src/usr.sbin/mtree.orig/compare.c src/usr.sbin/mtree/compare.c
--- src/usr.sbin/mtree.orig/compare.c Fri Jan 12 13:17:18 2001
+++ src/usr.sbin/mtree/compare.c Fri Mar 29 08:28:16 2002
@@ -178,6 +178,12 @@
tab, s->st_size, p->fts_statp->st_size);
tab = "\t";
}
+ if (s->flags & F_INUM && s->st_ino != p->fts_statp->st_ino) {
+ LABEL;
+ (void)printf("%sinode expected %u found %u\n",
+ tab, s->st_ino, p->fts_statp->st_ino);
+ tab = "\t";
+ }
/*
* XXX
* Catches nano-second differences, but doesn't display them.
diff -u src/usr.sbin/mtree.orig/create.c src/usr.sbin/mtree/create.c
--- src/usr.sbin/mtree.orig/create.c Fri Jan 12 13:17:18 2001
+++ src/usr.sbin/mtree/create.c Fri Mar 29 08:31:24 2002
@@ -218,6 +218,8 @@
(void)close(fd);
output(indent, &offset, "cksum=%lu", val);
}
+ if (keys & F_INUM)
+ output(indent, &offset, "inum=%u", p->fts_statp->st_ino);
#ifdef MD5
if (keys & F_MD5 && S_ISREG(p->fts_statp->st_mode)) {
char *digest, buf[33];
diff -u src/usr.sbin/mtree.orig/misc.c src/usr.sbin/mtree/misc.c
--- src/usr.sbin/mtree.orig/misc.c Tue Jun 27 21:33:17 2000
+++ src/usr.sbin/mtree/misc.c Fri Mar 29 08:42:56 2002
@@ -65,6 +65,7 @@
{"gid", F_GID, NEEDVALUE},
{"gname", F_GNAME, NEEDVALUE},
{"ignore", F_IGN, 0},
+ {"inum", F_INUM, NEEDVALUE},
{"link", F_SLINK, NEEDVALUE},
#ifdef MD5
{"md5digest", F_MD5, NEEDVALUE},
diff -u src/usr.sbin/mtree.orig/mtree.8 src/usr.sbin/mtree/mtree.8
--- src/usr.sbin/mtree.orig/mtree.8 Thu Aug 16 10:56:08 2001
+++ src/usr.sbin/mtree/mtree.8 Fri Mar 29 10:38:42 2002
@@ -226,6 +226,8 @@
.It Cm socket
socket
.El
+.It Cm inum
+The inode number of the file.
.El
.Pp
The default set of keywords are
diff -u src/usr.sbin/mtree.orig/mtree.h src/usr.sbin/mtree/mtree.h
--- src/usr.sbin/mtree.orig/mtree.h Thu Dec 9 14:38:35 1999
+++ src/usr.sbin/mtree/mtree.h Mon Apr 1 16:07:21 2002
@@ -58,6 +58,7 @@
mode_t st_mode; /* mode */
u_long st_flags; /* flags */
nlink_t st_nlink; /* link count */
+ ino_t st_ino; /* inode number */
#define F_CKSUM 0x0001 /* check sum */
#define F_DONE 0x0002 /* directory done */
@@ -81,6 +82,7 @@
#define F_RMD160 0x40000 /* RIPEMD160 digest */
#define F_FLAGS 0x80000 /* file flags */
u_int flags; /* items set */
+#define F_INUM 0x100000 /* inode number */
#define F_BLOCK 0x001 /* block special */
#define F_CHAR 0x002 /* char special */
diff -u src/usr.sbin/mtree.orig/spec.c src/usr.sbin/mtree/spec.c
--- src/usr.sbin/mtree.orig/spec.c Tue Jun 27 21:33:17 2000
+++ src/usr.sbin/mtree/spec.c Fri Mar 29 08:34:27 2002
@@ -307,6 +307,12 @@
errx(1, "line %d: unknown user %s", lineno, val);
ip->st_uid = pw->pw_uid;
break;
+ case F_INUM:
+ ip->st_ino = strtoul(val, &ep, 10);
+ if (*ep)
+ errx(1, "line %d: invalid inode number %s",
+ lineno, val);
+ break;
}
}
}
mtree.excerpt.txt
(text/plain, 835 B)
[ryanb@m1 ~] $ date
Fri Mar 29 16:54:37 CST 2002
[ryanb@m1 ~] $ mtree -c -x -p . -k flags,uid,gid,nlink,mode,sha1digest,size,link,time,type,inum > /tmp/myhome.mtree
[ryanb@m1 ~] $ ls -i mtree.inode.patch
8076 mtree.inode.patch
[ryanb@m1 ~] $ cp -p mtree.inode.patch mtree.inode.patch.blargh
[ryanb@m1 ~] $ ls -i mtree.inode.patch*
8076 mtree.inode.patch 8078 mtree.inode.patch.blargh
[ryanb@m1 ~] $ rm mtree.inode.patch
[ryanb@m1 ~] $ mv mtree.inode.patch.blargh mtree.inode.patch
[ryanb@m1 ~] $ ls -i mtree.inode.patch
8078 mtree.inode.patch
[ryanb@m1 ~] $ mtree -x -p . -k flags,uid,gid,nlink,mode,sha1digest,size,link,time,type,inum < /tmp/myhome.mtree
. changed
modification time expected Fri Mar 29 16:48:04 2002 found Fri Mar 29 16:57:04 2002
mtree.inode.patch changed
inode expected 8076 found 8078
signature.asc
(application/pgp-signature, 230 B)
-----BEGIN PGP SIGNATURE----- Version: GnuPG v1.0.6 (FreeBSD) Comment: For info see http://www.gnupg.org iD8DBQE8qhdGCbo22TYyHRMRAs1KAJ0deEjnybwopjP4jfd/3+oAnBKG4wCaAjWM XD0g6GNHm0cobiygZJjdPJk= =3l7n -----END PGP SIGNATURE-----