HardenedBSD/etc/mtree/BSD.var.dist

# $FreeBSD$
#
# Please see the file src/etc/mtree/README before making changes to this file.
#

/set type=dir uname=root gname=wheel mode=0755
.
    account
    ..
    at
/set uname=daemon
        jobs
        ..
        spool
        ..
/set uname=root
    ..
/set mode=0750
/set gname=audit
    audit
        dist            uname=auditdistd gname=audit mode=0770
        ..
        remote          uname=auditdistd gname=wheel mode=0700
        ..
    ..
    authpf              uname=root gname=authpf mode=0770
    ..
/set gname=wheel
    backups
    ..
    cache		mode=0755
    ..
    crash
    ..
    cron
        tabs            mode=0700
        ..
    ..
/set mode=0755
    db
        entropy         uname=operator gname=operator mode=0700
        ..
        freebsd-update  mode=0700
        ..
        ipf             mode=0700
        ..
        pkg
        ..
        ports
        ..
        portsnap
        ..
    ..
    empty           mode=0555 flags=schg
    ..
    games           gname=games mode=0775
    ..
    heimdal         mode=0700
    ..
    log
    ..
    mail            gname=mail mode=0775
    ..
    msgs            uname=daemon
    ..
    preserve
    ..
    run
        ppp             gname=network mode=0770
        ..
        wpa_supplicant
        ..
    ..
    rwho            gname=daemon mode=0775
    ..
    spool
        dma             uname=root gname=mail mode=0770
        ..
        lock            uname=uucp gname=dialer mode=0775
        ..
/set gname=daemon
        lpd
        ..
        mqueue
        ..
        opielocks       mode=0700
        ..
        output
            lpd
            ..
        ..
/set gname=wheel
    ..
    tmp             mode=01777
        vi.recover      mode=01777
        ..
    ..
    unbound         uname=unbound gname=unbound mode=0755
        conf.d          uname=unbound gname=unbound mode=0755
        ..
    ..
    yp
    ..
..
$Id$ -> $FreeBSD$ 1999-08-28 01:37:10 +02:00			`# $FreeBSD$`
Fix script in README to actually work, empty lines produce as much a diff as lines with the wrong stuff on it. Add references in mtree data files to the README. 1999-08-23 07:12:43 +02:00			`#`
Mention the path to the README file in the header comment. Submitted by: Rich Morin <rdm@cfcl.com> 2001-06-26 15:50:33 +02:00			`# Please see the file src/etc/mtree/README before making changes to this file.`
Initial import of 386BSD 0.1 othersrc/etc 1993-06-20 15:41:45 +02:00			`#`

Change file ownership from bin.bin to root.wheel. 1998-09-14 10:34:45 +02:00			`/set type=dir uname=root gname=wheel mode=0755`
Simplify these now that default owner is root.wheel. Partially reviewed by: bde 1998-09-19 20:50:27 +02:00			`.`
Regenerate these using mtree -cdinx -kuname,gname,mode on a very recently built release after fixing all the wrong directory permissions in that release. Then use diff -c -b to verify them against the old versions, nothing but new directories added :-). And a lot of alphabetizing done! 1995-05-17 11:31:17 +02:00			`account`
These are mtree generated versions of these files using the new mtree options. I will be updating these shortly to remove some old stuff and add some new stuff. These currently produce the exact same trees as they did. 1994-09-19 03:40:40 +02:00			`..`
Apparently, people do not listen for a plea to look into the README file before making changes here. Fix them once again. 2001-02-15 13:25:48 +01:00			`at`
			`/set uname=daemon`
Regenerate these using mtree -cdinx -kuname,gname,mode on a very recently built release after fixing all the wrong directory permissions in that release. Then use diff -c -b to verify them against the old versions, nothing but new directories added :-). And a lot of alphabetizing done! 1995-05-17 11:31:17 +02:00			`jobs`
			`..`
			`spool`
These are mtree generated versions of these files using the new mtree options. I will be updating these shortly to remove some old stuff and add some new stuff. These currently produce the exact same trees as they did. 1994-09-19 03:40:40 +02:00			`..`
Apparently, people do not listen for a plea to look into the README file before making changes here. Fix them once again. 2001-02-15 13:25:48 +01:00			`/set uname=root`
These are mtree generated versions of these files using the new mtree options. I will be updating these shortly to remove some old stuff and add some new stuff. These currently produce the exact same trees as they did. 1994-09-19 03:40:40 +02:00			`..`
Apparently, people do not listen for a plea to look into the README file before making changes here. Fix them once again. 2001-02-15 13:25:48 +01:00			`/set mode=0750`
Change group for /var/audit to audit, so that audit review can be delegated to non-administrators. Obtained from: TrustedBSD Project 2006-02-05 19:22:56 +01:00			`/set gname=audit`
Add /var/audit, mode 750, which will hold audit trail files. Obtained from: TrustedBSD Project 2006-02-02 02:19:31 +01:00			`audit`
Merge a number of changes required to hook up OpenBSM 1.2-alpha2's auditdistd (distributed audit daemon) to the build: - Manual cross references - Makefile for auditdistd - rc.d script, rc.conf entrie - New group and user for auditdistd; associated aliases, etc. The audit trail distribution daemon provides reliable, cryptographically protected (and sandboxed) delivery of audit tails from live clients to audit server hosts in order to both allow centralised analysis, and improve resilience in the event of client compromises: clients are not permitted to change trail contents after submission. Submitted by: pjd Sponsored by: The FreeBSD Foundation (auditdistd) 2012-12-01 16:11:46 +01:00			`dist uname=auditdistd gname=audit mode=0770`
			`..`
			`remote uname=auditdistd gname=wheel mode=0700`
			`..`
Fix location of /var/audit/dist and /var/audit/remote. Note that those who did installworld after r243752 should remove wrongly created /var/dist and /var/remote. Reviewed by: pjd 2012-12-28 11:42:01 +01:00			`..`
authpf needs /var/authpf to exist and be writable by group authpf. 2013-09-05 14:35:23 +02:00			`authpf uname=root gname=authpf mode=0770`
			`..`
Change group for /var/audit to audit, so that audit review can be delegated to non-administrators. Obtained from: TrustedBSD Project 2006-02-05 19:22:56 +01:00			`/set gname=wheel`
Apparently, people do not listen for a plea to look into the README file before making changes here. Fix them once again. 2001-02-15 13:25:48 +01:00			`backups`
These are mtree generated versions of these files using the new mtree options. I will be updating these shortly to remove some old stuff and add some new stuff. These currently produce the exact same trees as they did. 1994-09-19 03:40:40 +02:00			`..`
Create /var/cache with mode 0755 instead of 0750. This directory is used by many third party applications and having permission 0750 makes it impossible to drop group privileges. MFC after: 3 days 2013-11-26 21:03:25 +01:00			`cache mode=0755`
- Merge in OFED 1.5.3 from projects/ofed/head 2011-03-21 10:58:24 +01:00			`..`
Apparently, people do not listen for a plea to look into the README file before making changes here. Fix them once again. 2001-02-15 13:25:48 +01:00			`crash`
These are mtree generated versions of these files using the new mtree options. I will be updating these shortly to remove some old stuff and add some new stuff. These currently produce the exact same trees as they did. 1994-09-19 03:40:40 +02:00			`..`
Apparently, people do not listen for a plea to look into the README file before making changes here. Fix them once again. 2001-02-15 13:25:48 +01:00			`cron`
			`tabs mode=0700`
These are mtree generated versions of these files using the new mtree options. I will be updating these shortly to remove some old stuff and add some new stuff. These currently produce the exact same trees as they did. 1994-09-19 03:40:40 +02:00			`..`
			`..`
Apparently, people do not listen for a plea to look into the README file before making changes here. Fix them once again. 2001-02-15 13:25:48 +01:00			`/set mode=0755`
			`db`
			`entropy uname=operator gname=operator mode=0700`
			`..`
Disable SSL renegotiation in order to protect against a serious protocol flaw. [09:15] Correctly handle failures from unsetenv resulting from a corrupt environment in rtld-elf. [09:16] Fix permissions in freebsd-update in order to prevent leakage of sensitive files. [09:17] Approved by: so (cperciva) Security: FreeBSD-SA-09:15.ssl Security: FreeBSD-SA-09:16.rtld Security: FreeBSD-SA-09:17.freebsd-udpate 2009-12-03 10:18:40 +01:00			`freebsd-update mode=0700`
Add FreeBSD Update 2.0 client code. The build code is in the projects repository. Sponsored by: FreeBSD security development fundraiser 2006-08-31 11:51:34 +02:00			`..`
Apply README style guidelines (this time checked). 2001-11-19 11:10:27 +01:00			`ipf mode=0700`
Create /var/db/ipf PR: 27070 2001-10-20 06:33:12 +02:00			`..`
Apparently, people do not listen for a plea to look into the README file before making changes here. Fix them once again. 2001-02-15 13:25:48 +01:00			`pkg`
Add /var/db/pkg. Submitted by: John Hay <jhay@mikom.csir.co.za> 1999-03-31 09:06:39 +02:00			`..`
Add /var/db/ports/ (support directory necessary for ports that use the new OPTIONS infrastructure) 2004-01-20 14:51:23 +01:00			`ports`
			`..`
Add portsnap to the base system. This is a secure, easy to use, fast, lightweight, and generally good way for users to keep their ports trees up to date. This is version 0.9.4 from the ports tree (sysutils/portsnap) with the following changes: 1. The experimental pipelined http code is enabled. No seatbelts in -CURRENT. (^_^) 2. The working directory has moved from /usr/local/portsnap to /var/db/portsnap (as discussed on -arch two days ago). 3. Portsnap now fetches a list of mirrors (distributed as DNS SRV records) and selects one randomly. This should help to avoid the uneven loading which plagues the cvsup mirror network. 4. The license is now 2-clause BSD instead of 3-clause BSD. 5. Various incidental changes to make portsnap fit into the base system's build mechanics. X-MFC-After: 6.0-RELEASE X-MFC-Before: 5.5-RELEASE X-MFC-To: RELENG_6, RELENG_5, ports discussed on: -arch and several other places "yes please" from: simon, remko, flz, Diane Bruce thinks this is a great idea: bsdimp Hopes he didn't forget any files: cperciva 2005-08-08 22:10:06 +02:00			`portsnap`
			`..`
These are mtree generated versions of these files using the new mtree options. I will be updating these shortly to remove some old stuff and add some new stuff. These currently produce the exact same trees as they did. 1994-09-19 03:40:40 +02:00			`..`
Scheduled sweep using the README guidelines. Approved by: re (rwatson) 2003-11-29 19:22:01 +01:00			`empty mode=0555 flags=schg`
Add /var/empty for the OpenSSH privsep code. 2002-06-23 22:44:19 +02:00			`..`
Scheduled sweep using the README guidelines. Approved by: re (rwatson) 2003-11-29 19:22:01 +01:00			`games gname=games mode=0775`
Restore /var/games; lots of ports' games use it. 2002-11-04 08:50:48 +01:00			`..`
Style these once again. 2001-10-25 14:16:51 +02:00			`heimdal mode=0700`
Build standard directory for kerberos 5 (Heimdal) database. 2001-07-28 22:00:54 +02:00			`..`
Simplify these now that default owner is root.wheel. Partially reviewed by: bde 1998-09-19 20:50:27 +02:00			`log`
These are mtree generated versions of these files using the new mtree options. I will be updating these shortly to remove some old stuff and add some new stuff. These currently produce the exact same trees as they did. 1994-09-19 03:40:40 +02:00			`..`
Apply README style guidelines (this time checked). 2001-11-19 11:10:27 +01:00			`mail gname=mail mode=0775`
These are mtree generated versions of these files using the new mtree options. I will be updating these shortly to remove some old stuff and add some new stuff. These currently produce the exact same trees as they did. 1994-09-19 03:40:40 +02:00			`..`
Change owner of msgs to daemon, sendmail msgs alias not works in other case, sendmail change itself to daemon.daemon before executing program. 1995-11-19 17:50:34 +01:00			`msgs uname=daemon`
These are mtree generated versions of these files using the new mtree options. I will be updating these shortly to remove some old stuff and add some new stuff. These currently produce the exact same trees as they did. 1994-09-19 03:40:40 +02:00			`..`
Simplify these now that default owner is root.wheel. Partially reviewed by: bde 1998-09-19 20:50:27 +02:00			`preserve`
These are mtree generated versions of these files using the new mtree options. I will be updating these shortly to remove some old stuff and add some new stuff. These currently produce the exact same trees as they did. 1994-09-19 03:40:40 +02:00			`..`
Simplify these now that default owner is root.wheel. Partially reviewed by: bde 1998-09-19 20:50:27 +02:00			`run`
Add a directory in /var/run to store ppp(8) command sockets. PR: bin/29966 Approved by: brian MFC after: 4 2001-11-02 00:44:12 +01:00			`ppp gname=network mode=0770`
Fix a bug I introduced yesterday. People who built world since the previous commit yesterday may wish to check /var/run for junk. 2001-11-02 23:00:17 +01:00			`..`
Create the var/run/wpa_supplicant directory where the wpa_supplicant RC script wants to save a pidfile for each interface. MFC after: 2 weeks 2010-09-10 10:27:02 +02:00			`wpa_supplicant`
			`..`
These are mtree generated versions of these files using the new mtree options. I will be updating these shortly to remove some old stuff and add some new stuff. These currently produce the exact same trees as they did. 1994-09-19 03:40:40 +02:00			`..`
Apply README style guidelines (this time checked). 2001-11-19 11:10:27 +01:00			`rwho gname=daemon mode=0775`
These are mtree generated versions of these files using the new mtree options. I will be updating these shortly to remove some old stuff and add some new stuff. These currently produce the exact same trees as they did. 1994-09-19 03:40:40 +02:00			`..`
Apparently, people do not listen for a plea to look into the README file before making changes here. Fix them once again. 2001-02-15 13:25:48 +01:00			`spool`
Fix typo 2014-02-21 11:34:59 +01:00			`dma uname=root gname=mail mode=0770`
Import Dragonfly Mail Agent into base system It is a small and lightweight Mail Transport Agent. It accepts mails from locally installed Mail User Agents (MUA) and delivers the mails either locally or to a remote destination. Remote delivery includes several features like TLS/SSL support, SMTP authentication and NULLCLIENT. Make dma conditional to new WITHOUT_DMA option and make it respect WITHOUT_MAIL Reviewed by: peter Discussed with: emaste, bz, peter 2014-02-21 08:26:49 +01:00			`..`
Apply README style guidelines (this time checked). 2001-11-19 11:10:27 +01:00			`lock uname=uucp gname=dialer mode=0775`
These are mtree generated versions of these files using the new mtree options. I will be updating these shortly to remove some old stuff and add some new stuff. These currently produce the exact same trees as they did. 1994-09-19 03:40:40 +02:00			`..`
Apparently, people do not listen for a plea to look into the README file before making changes here. Fix them once again. 2001-02-15 13:25:48 +01:00			`/set gname=daemon`
Old nit lying around in a source tree: Slightly optimize the number of uname/gname overrides and /sets. 1998-12-16 06:50:25 +01:00			`lpd`
These are mtree generated versions of these files using the new mtree options. I will be updating these shortly to remove some old stuff and add some new stuff. These currently produce the exact same trees as they did. 1994-09-19 03:40:40 +02:00			`..`
Old nit lying around in a source tree: Slightly optimize the number of uname/gname overrides and /sets. 1998-12-16 06:50:25 +01:00			`mqueue`
These are mtree generated versions of these files using the new mtree options. I will be updating these shortly to remove some old stuff and add some new stuff. These currently produce the exact same trees as they did. 1994-09-19 03:40:40 +02:00			`..`
This cleans up all the white space errors so that the next commit is easier to understand. 1999-08-24 05:51:34 +02:00			`opielocks mode=0700`
			`..`
Old nit lying around in a source tree: Slightly optimize the number of uname/gname overrides and /sets. 1998-12-16 06:50:25 +01:00			`output`
This cleans up all the white space errors so that the next commit is easier to understand. 1999-08-24 05:51:34 +02:00			`lpd`
			`..`
These are mtree generated versions of these files using the new mtree options. I will be updating these shortly to remove some old stuff and add some new stuff. These currently produce the exact same trees as they did. 1994-09-19 03:40:40 +02:00			`..`
Apply README style guidelines (this time checked). 2001-11-19 11:10:27 +01:00			`/set gname=wheel`
These are mtree generated versions of these files using the new mtree options. I will be updating these shortly to remove some old stuff and add some new stuff. These currently produce the exact same trees as they did. 1994-09-19 03:40:40 +02:00			`..`
Apparently, people do not listen for a plea to look into the README file before making changes here. Fix them once again. 2001-02-15 13:25:48 +01:00			`tmp mode=01777`
			`vi.recover mode=01777`
Regenerate these using mtree -cdinx -kuname,gname,mode on a very recently built release after fixing all the wrong directory permissions in that release. Then use diff -c -b to verify them against the old versions, nothing but new directories added :-). And a lot of alphabetizing done! 1995-05-17 11:31:17 +02:00			`..`
			`..`
Fix indentation. Approved by: re (blanket) 2013-09-22 20:31:49 +02:00			`unbound uname=unbound gname=unbound mode=0755`
Create /var/unbound/conf.d for additional configuration files. Ensure that it is used if present. MFH: 3 weeks 2014-05-30 00:34:04 +02:00			`conf.d uname=unbound gname=unbound mode=0755`
			`..`
Build and install the Unbound caching DNS resolver daemon. Approved by: re (blanket) 2013-09-15 16:51:23 +02:00			`..`
Old nit lying around in a source tree: Slightly optimize the number of uname/gname overrides and /sets. 1998-12-16 06:50:25 +01:00			`yp`
These are mtree generated versions of these files using the new mtree options. I will be updating these shortly to remove some old stuff and add some new stuff. These currently produce the exact same trees as they did. 1994-09-19 03:40:40 +02:00			`..`
Initial import of 386BSD 0.1 othersrc/etc 1993-06-20 15:41:45 +02:00			`..`