From: Unix-Wizards-Request@BRL.MIL
Newsgroups: comp.unix.wizards
Subject: UNIX-WIZARDS Digest  V14#151
Date: 14 Apr 92 09:52:40 GMT

<----RFC822 headers-----
Received: from SEM.BRL.MIL ([192.5.23.8]) by alpha.xerox.com with SMTP id
<11642>; Mon, 30 Mar 1992 15:43:48 PST
Received: from SEM.BRL.MIL by SEM.BRL.MIL id aa15076; 30 Mar 92 15:30 EST
Received: from sem.brl.mil by SEM.BRL.MIL id aa14802; 30 Mar 92 15:15 EST
From:	The Moderator (Mike Muuss) <Unix-Wizards-Request@brl.mil>
Redistributed: unixwizards:All Areas:Xerox
-----RFC822 headers---->

UNIX-WIZARDS Digest          Mon, 30 Mar 1992              V14#151

Today's Topics:
                                Help me.
                           tty/pipe question
                       Writing NIT Packet Filters
Intro to comp.unix.wizards - read before posting (weekly announcement, last
change: Feb 29 17:20)
       /tmp & /swap bug in SunOS 4.1.1 which causes system crash

-----------------------------------------------------------------

From: 9125113g@lux.latrobe.edu.au
Subject: Help me.
Date: 27 Mar 92 04:42:02 GMT
To:       unix-wizards@sem.brl.mil


How do you create a directory under unix.

Thanks ... could you e-mail me as I don't read this group.
Personally I think Unix sucks anyway.

Mitchell Davies.

9125113g@lux.latrobe.edu.au

-----------------------------

From: Rob Ballantyne <ballanty@cs.sfu.ca>
Subject: tty/pipe question
Date: 28 Mar 92 20:41:01 GMT
To:       unix-wizards@sem.brl.mil


  I hope this question lives up to the `wizardly' level of this
group if not let me know and I'll ask the question else where!


  I am trying to write a `watcher', a program that will replace the
the shell that a potential hacker uses and will log all his actions
to some file.

  This is the current layout of processes that I have:


                           stdin or /dev/console
                                  |
                                  |
                            ----------------
                            | process #1   |
                            ----------------
                                / |
                      pipe #1 /   |
                            /     |
                          /       |
            ----------------      |
            | process #2   |      |
            |  (/bin/csh)  |      |
            ----------------      |
                   |              |
            ----------------      |
            | process #3   |      |
            ----------------      |
                   |\             |
                   |  \           |
                   |    \         |
                   |      \       |
                   |        \     |
                   |          \   |
                   |            \ |
                stdout        LOGFILE


  The current problem I face is that the real /bin/csh checks to see
that it's input is a tty and if it is not csh goes into some batch
mode!  This is exactly what I don't want to happen.  I want as much
as possible that my csh replacement is indistinguisable from the real
thing (at least operationally).  This brings us to the question:

  Can I make /bin/csh think that it's input (pipe #1) is the actual
stdin or /dev/console that is feeding process #1?

I appreciate any advice givin!

Thanks,

Rob

--
 --------------------------------------------------------------------------
| Rob Ballantyne                         |             _____             |
| email: ballanty@cs.sfu.ca              |               |               |
| Simon Fraser University, Department of |    -----------O-----------    |

-----------------------------

From: Sean Coleman 497-5672  <coleman@bldrdoc.gov>
Subject: Writing NIT Packet Filters
Keywords: Examples
Date: 29 Mar 92 19:40:34 GMT
Followup-To: poster
To:       unix-wizards@sem.brl.mil

The am trying to write a NIT packet filter to only
allow ICMP packets to be passed through. My problem is
getting past the first test where we check to see if the
packet is an IP packet. If the packet does not have a type
IP, the packet filter should quit and reject the packet. Is
this where you want to use the short circuit binary operators?

It is not clear to me what the enf_nopush and enf_nop are really
for and how to use them. I would like to get further info about
this.


Any example would be helpful since the one in the man pages is
pretty basic.

Thanks

Sean Coleman
coleman@bldrdoc.gov

-----------------------------

From: Brian Fitzgerald <fitz@mml0.meche.rpi.edu>
Subject: Intro to comp.unix.wizards - read before posting (weekly announcement,
last change: Feb 29 17:20)
Date: 29 Mar 92 19:44:33 GMT
Expires: Sun, 19 Apr 1992 19:44:15 GMT
Followup-To: poster
To:       unix-wizards@sem.brl.mil

Please take a moment to read this before posting to comp.unix.wizards
for the first time.

comp.unix.wizards is for in-depth discussion of advanced unix topics.

Please do not post elementary questions to comp.unix.wizards.  Although
some socket questions (for example) are appropriate, "How do I program
with sockets?" is not.

Crossposting questions to both comp.unix.wizards and
comp.unix.questions is inappropriate.  Wizards often read
comp.unix.questions and answer questions there.

What is a wizard?  A wizard is someone who can rewrite the entire
system from scratch.  Most of us cannot, and therefore do not ask or
answer questions here.  But please do follow along the discussions.
You'll learn quite a bit about how UNIX works.

For a list of answers to frequently asked questions (FAQ), please refer
to comp.unix.questions (or comp.lang.c, news.answers, etc...).  "How do
I delete a file whose name starts with a '-' ?" is an example of such a
question.  Please do not ask or answer FAQ's on the net.

Write to Unix-Wizards-Request@BRL.MIL (Subject: subscribe.  Any
message.) if you want a daily digest of this newsgroup mailed to you.

E-mail comments about this posting are welcome.  From time to time I'll
summarize them.

Brian
--
These opinions are mine, and do not necessarily reflect those of any
academic department or computing service at Rensselaer.

-----------------------------

From: Michael Haardt <u31b3hs@kaa.informatik.rwth-aachen.de>
Subject: /tmp & /swap bug in SunOS 4.1.1 which causes system crash
Date: 30 Mar 92 07:26:11 GMT
To:       unix-wizards@sem.brl.mil

To my own surprise I found aother weak point in SunOS.  No, I will not
complain about ps with other symbol tables again, the problem are the
following commands:

cd /tmp
mkdir foo
mkdir foo/bar
touch foo/bar/y2
chmod 0 foo/bar
chmod 777 foo
cd foo
mv bar ..

If your system is configured to use the same space for swapping and
/tmp, it will crash with "kernel panic: tmp_rename" after typing the
last command and reboot.

I have not tested if these commands can be simplified, but the mode 0
seems essential.  Our suns need pretty long for booting and I can't
crash them all to find out ... the other users will hunt me :)

In my mind, mv should say "Permission denied" if a normal user tries it
and just do it, when root invokes these commands.  I am not sure why I
don't have permission to move bar, because the move will only be an operation
on the directory foo and /tmp, and I can do a stat to get the inode for
the new directory entry anyway, can someone enlighten me?  If bar would
be empty, I could remove it regardless of the permissions, so what is
wrong about moving it?

Michael

-----------------------------


End of UNIX-WIZARDS Digest
**************************