1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
|
MTREE(8) NetBSD System Manager's Manual MTREE(8)
NNAAMMEE
mmttrreeee -- map a directory hierarchy
SSYYNNOOPPSSIISS
mmttrreeee [--ccCCddDDeellLLMMPPrruuUUWWxx] [--ii | --mm] [--ff _s_p_e_c] [--pp _p_a_t_h] [--kk _k_e_y_w_o_r_d_s]
[--KK _k_e_y_w_o_r_d_s] [--RR _k_e_y_w_o_r_d_s] [--EE _t_a_g_s] [--II _t_a_g_s] [--NN _d_b_d_i_r]
[--ss _s_e_e_d] [--XX _e_x_c_l_u_d_e_-_f_i_l_e]
DDEESSCCRRIIPPTTIIOONN
The mmttrreeee utility compares the file hierarchy rooted in the current
directory against a specification read from the standard input. Messages
are written to the standard output for any files whose characteristics do
not match the specification, or which are missing from either the file
hierarchy or the specification.
The options are as follows:
--cc Print a specification for the file hierarchy to the standard out-
put.
--dd Ignore everything except directory type files.
--CC Print (`dump') the specification as provided by --ff _s_p_e_c in a format
that's easier to parse with various tools. The full path name is
always printed as the first field, and --kk, --KK, and --RR can be used
to control which other keywords are printed, and --EE and --II can be
used to control which files are printed.
--DD As per --CC, except that the path name is always printed as the last
field instead of the first.
--EE _t_a_g_s
Add the comma separated tags to the ``exclusion'' list. Non-direc-
tories with tags which are in the exclusion list are not printed
with --DD.
--ee Don't complain about files that are in the file hierarchy, but not
in the specification.
--ff _s_p_e_c
Read the specification from _f_i_l_e, instead of from the standard
input.
--II _t_a_g_s
Add the comma separated tags to the ``inclusion'' list. Non-direc-
tories with tags which are in the inclusion list are printed with
--DD. If no inclusion list is provided, the default is to display
all files.
--ii If specified, set the schg and/or sappnd flags.
--KK _k_e_y_w_o_r_d_s
Add the specified (whitespace or comma separated) keywords to the
current set of keywords. If `all' is specified, add all of the
other keywords.
--kk _k_e_y_w_o_r_d_s
Use the ttyyppee keyword plus the specified (whitespace or comma sepa-
rated) keywords instead of the current set of keywords. If `all'
is specified, use all of the other keywords. If the ttyyppee keyword
is not desired, suppress it with --RR _t_y_p_e.
--ll Do ``loose'' permissions checks, in which more stringent permis-
sions will match less stringent ones. For example, a file marked
mode 0444 will pass a check for mode 0644. ``Loose'' checks apply
only to read, write and execute permissions -- in particular, if
other bits like the sticky bit or suid/sgid bits are set either in
the specification or the file, exact checking will be performed.
This flag may not be set at the same time as the --uu or --UU flags.
--LL Follow all symbolic links in the file hierarchy.
--mm If the schg and/or sappnd flags are specified, reset these flags.
Note that this is only possible with securelevel less than 1 (i.e.
in single user mode or while the system is running in insecure
mode). See init(8) for information on security levels.
--MM Permit merging of specification entries with different types, with
the last entry take precedence.
--NN _d_b_d_i_r
Use the user database text file _m_a_s_t_e_r_._p_a_s_s_w_d and group database
text file _g_r_o_u_p from _d_b_d_i_r, rather than using the results from the
system's getpwnam(3) and getgrnam(3) (and related) library calls.
--pp _p_a_t_h
Use the file hierarchy rooted in _p_a_t_h, instead of the current
directory.
--PP Don't follow symbolic links in the file hierarchy, instead consider
the symbolic link itself in any comparisons. This is the default.
--rr Remove any files in the file hierarchy that are not described in
the specification.
--RR _k_e_y_w_o_r_d_s
Remove the specified (whitespace or comma separated) keywords from
the current set of keywords. If `all' is specified, remove all of
the other keywords.
--ss _s_e_e_d
Display a single checksum to the standard error output that repre-
sents all of the files for which the keyword cckkssuumm was specified.
The checksum is seeded with the specified value.
--uu Modify the owner, group, permissions, and flags of existing files,
the device type of devices, and symbolic link targets, to match the
specification. Create any missing directories, devices or symbolic
links. User, group, and permissions must all be specified for
missing directories to be created. Note that unless the --ii option
is given, the schg and sappnd flags will not be set, even if speci-
fied. If --mm is given, these flags will be reset. Exit with a sta-
tus of 0 on success, 2 if the file hierarchy did not match the
specification, and 1 if any other error occurred.
--UU Same as --uu except that a mismatch is not considered to be an error
if it was corrected.
--WW Don't attempt to set various file attributes such as the ownership,
mode, flags, or time when creating new directories or changing
existing entries. This option will be most useful when used in
conjunction with --uu or --UU.
--xx Don't descend below mount points in the file hierarchy.
--XX _e_x_c_l_u_d_e_-_f_i_l_e
The specified file contains fnmatch(3) patterns matching files to
be excluded from the specification, one to a line. If the pattern
contains a `/' character, it will be matched against entire path-
names (relative to the starting directory); otherwise, it will be
matched against basenames only. Comments are permitted in the
_e_x_c_l_u_d_e_-_l_i_s_t file.
Specifications are mostly composed of ``keywords'', i.e. strings that
that specify values relating to files. No keywords have default values,
and if a keyword has no value set, no checks based on it are performed.
Currently supported keywords are as follows:
cckkssuumm The checksum of the file using the default algorithm specified by
the cksum(1) utility.
ddeevviiccee The device number to use for bblloocckk or cchhaarr file types. The argu-
ment must be one of the following forms:
_f_o_r_m_a_t,_m_a_j_o_r,_m_i_n_o_r
A device with _m_a_j_o_r and _m_i_n_o_r fields, for an operating sys-
tem specified with _f_o_r_m_a_t. See below for valid formats.
_f_o_r_m_a_t,_m_a_j_o_r,_u_n_i_t,_s_u_b_u_n_i_t
A device with _m_a_j_o_r, _u_n_i_t, and _s_u_b_u_n_i_t fields, for an oper-
ating system specified with _f_o_r_m_a_t. (Currently this is
only supported by the bbssddooss format.)
_n_u_m_b_e_r
Opaque number (as stored on the file system).
The following values for _f_o_r_m_a_t are recognized: nnaattiivvee, 338866bbssdd,
44bbssdd, bbssddooss, ffrreeeebbssdd, hhppuuxx, iisscc, lliinnuuxx, nneettbbssdd, oossff11, ssccoo,
ssoollaarriiss, ssuunnooss, ssvvrr33, ssvvrr44, and uullttrriixx.
See mknod(8) for more details.
ffllaaggss The file flags as a symbolic name. See chflags(1) for informa-
tion on these names. If no flags are to be set the string `none'
may be used to override the current default. Note that the schg
and sappnd flags are treated specially (see the --ii and --mm
options).
iiggnnoorree Ignore any file hierarchy below this file.
ggiidd The file group as a numeric value.
ggnnaammee The file group as a symbolic name.
lliinnkk The file the symbolic link is expected to reference.
mmdd55 The MD5 cryptographic message digest of the file.
mmdd55ddiiggeesstt
Synonym for mmdd55.
mmooddee The current file's permissions as a numeric (octal) or symbolic
value.
nnlliinnkk The number of hard links the file is expected to have.
ooppttiioonnaall
The file is optional; don't complain about the file if it's not
in the file hierarchy.
rrmmdd116600 The RMD-160 cryptographic message digest of the file.
rrmmdd116600ddiiggeesstt
Synonym for rrmmdd116600.
sshhaa11 The SHA-1 cryptographic message digest of the file.
sshhaa11ddiiggeesstt
Synonym for sshhaa11.
sshhaa225566 The 256-bits SHA-2 cryptographic message digest of the file.
sshhaa225566ddiiggeesstt
Synonym for sshhaa225566.
sshhaa338844 The 384-bits SHA-2 cryptographic message digest of the file.
sshhaa338844ddiiggeesstt
Synonym for sshhaa338844.
sshhaa551122 The 512-bits SHA-2 cryptographic message digest of the file.
sshhaa551122ddiiggeesstt
Synonym for sshhaa551122.
ssiizzee The size, in bytes, of the file.
ttaaggss Comma delimited tags to be matched with --EE and --II. These may be
specified without leading or trailing commas, but will be stored
internally with them.
ttiimmee The last modification time of the file.
ttyyppee The type of the file; may be set to any one of the following:
bblloocckk block special device
cchhaarr character special device
ddiirr directory
ffiiffoo fifo
ffiillee regular file
lliinnkk symbolic link
ssoocckkeett socket
uuiidd The file owner as a numeric value.
uunnaammee The file owner as a symbolic name.
The default set of keywords are ffllaaggss, ggiidd, lliinnkk, mmooddee, nnlliinnkk, ssiizzee,
ttiimmee, ttyyppee, and uuiidd.
There are four types of lines in a specification:
1. Set global values for a keyword. This consists of the string `/set'
followed by whitespace, followed by sets of keyword/value pairs,
separated by whitespace. Keyword/value pairs consist of a keyword,
followed by an equals sign (`='), followed by a value, without
whitespace characters. Once a keyword has been set, its value
remains unchanged until either reset or unset.
2. Unset global values for a keyword. This consists of the string
`/unset', followed by whitespace, followed by one or more keywords,
separated by whitespace. If `all' is specified, unset all of the
keywords.
3. A file specification, consisting of a path name, followed by white-
space, followed by zero or more whitespace separated keyword/value
pairs.
The path name may be preceded by whitespace characters. The path
name may contain any of the standard path name matching characters
(`[', `]', `?' or `*'), in which case files in the hierarchy will be
associated with the first pattern that they match. mmttrreeee uses
strsvis(3) (in VIS_CSTYLE format) to encode path names containing
non-printable characters. Whitespace characters are encoded as `\s'
(space), `\t' (tab), and `\n' (new line). `#' characters in path
names are escaped by a preceding backslash `\' to distinguish them
from comments.
Each of the keyword/value pairs consist of a keyword, followed by an
equals sign (`='), followed by the keyword's value, without white-
space characters. These values override, without changing, the
global value of the corresponding keyword.
The first path name entry listed must be a directory named `.', as
this ensures that intermixing full and relative path names will work
consistently and correctly. Multiple entries for a directory named
`.' are permitted; the settings for the last such entry override
those of the existing entry.
A path name that contains a slash (`/') that is not the first char-
acter will be treated as a full path (relative to the root of the
tree). All parent directories referenced in the path name must
exist. The current directory path used by relative path names will
be updated appropriately. Multiple entries for the same full path
are permitted if the types are the same (unless --MM is given, and
then the types may differ); in this case the settings for the last
entry take precedence.
A path name that does not contain a slash will be treated as a rela-
tive path. Specifying a directory will cause subsequent files to be
searched for in that directory hierarchy.
4. A line containing only the string `..' which causes the current
directory path (used by relative paths) to ascend one level.
Empty lines and lines whose first non-whitespace character is a hash mark
(`#') are ignored.
The mmttrreeee utility exits with a status of 0 on success, 1 if any error
occurred, and 2 if the file hierarchy did not match the specification.
FFIILLEESS
/etc/mtree system specification directory
EEXXAAMMPPLLEESS
To detect system binaries that have been ``trojan horsed'', it is recom-
mended that mmttrreeee be run on the file systems, and a copy of the results
stored on a different machine, or, at least, in encrypted form. The seed
for the --ss option should not be an obvious value and the final checksum
should not be stored on-line under any circumstances! Then, periodi-
cally, mmttrreeee should be run against the on-line specifications and the
final checksum compared with the previous value. While it is possible
for the bad guys to change the on-line specifications to conform to their
modified binaries, it shouldn't be possible for them to make it produce
the same final checksum value. If the final checksum value changes, the
off-line copies of the specification can be used to detect which of the
binaries have actually been modified.
The --dd and --uu options can be used in combination to create directory
hierarchies for distributions and other such things.
SSEEEE AALLSSOO
chflags(1), chgrp(1), chmod(1), cksum(1), stat(2), fnmatch(3), fts(3),
strsvis(3), chown(8), mknod(8)
HHIISSTTOORRYY
The mmttrreeee utility appeared in 4.3BSD-Reno. The ooppttiioonnaall keyword appeared
in NetBSD 1.2. The --UU flag appeared in NetBSD 1.3. The ffllaaggss and mmdd55
keywords, and --ii and --mm flags appeared in NetBSD 1.4. The ddeevviiccee,
rrmmdd116600, sshhaa11, ttaaggss, and aallll keywords, --DD, --EE, --II, --ll, --LL, --NN, --PP, --RR, --WW,
and --XX flags, and support for full paths appeared in NetBSD 1.6. The
sshhaa225566, sshhaa338844, and sshhaa551122 keywords appeared in NetBSD 3.0.
NetBSD 3.0 September 12, 2006 NetBSD 3.0
|
