1.\" Copyright (c) 1989, 1990, 1993 2.\" The Regents of the University of California. All rights reserved. 3.\" 4.\" Redistribution and use in source and binary forms, with or without 5.\" modification, are permitted provided that the following conditions 6.\" are met: 7.\" 1. Redistributions of source code must retain the above copyright 8.\" notice, this list of conditions and the following disclaimer. 9.\" 2. Redistributions in binary form must reproduce the above copyright 10.\" notice, this list of conditions and the following disclaimer in the 11.\" documentation and/or other materials provided with the distribution. 12.\" 4. Neither the name of the University nor the names of its contributors 13.\" may be used to endorse or promote products derived from this software 14.\" without specific prior written permission. 15.\" 16.\" THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND 17.\" ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 18.\" IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 19.\" ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE 20.\" FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 21.\" DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 22.\" OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 23.\" HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 24.\" LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 25.\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 26.\" SUCH DAMAGE. 27.\" 28.\" From: @(#)mtree.8 8.2 (Berkeley) 12/11/93
| 1.\" Copyright (c) 1989, 1990, 1993 2.\" The Regents of the University of California. All rights reserved. 3.\" 4.\" Redistribution and use in source and binary forms, with or without 5.\" modification, are permitted provided that the following conditions 6.\" are met: 7.\" 1. Redistributions of source code must retain the above copyright 8.\" notice, this list of conditions and the following disclaimer. 9.\" 2. Redistributions in binary form must reproduce the above copyright 10.\" notice, this list of conditions and the following disclaimer in the 11.\" documentation and/or other materials provided with the distribution. 12.\" 4. Neither the name of the University nor the names of its contributors 13.\" may be used to endorse or promote products derived from this software 14.\" without specific prior written permission. 15.\" 16.\" THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND 17.\" ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 18.\" IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 19.\" ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE 20.\" FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 21.\" DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 22.\" OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 23.\" HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 24.\" LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 25.\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 26.\" SUCH DAMAGE. 27.\" 28.\" From: @(#)mtree.8 8.2 (Berkeley) 12/11/93
|
32.Dt MTREE 8 33.Os 34.Sh NAME 35.Nm mtree 36.Nd map a directory hierarchy 37.Sh SYNOPSIS 38.Nm 39.Op Fl LPUcdeinqruxw 40.Bk -words 41.Op Fl f Ar spec 42.Ek 43.Bk -words 44.Op Fl f Ar spec 45.Ek 46.Bk -words 47.Op Fl K Ar keywords 48.Ek 49.Bk -words 50.Op Fl k Ar keywords 51.Ek 52.Bk -words 53.Op Fl p Ar path 54.Ek 55.Bk -words 56.Op Fl s Ar seed 57.Ek 58.Bk -words 59.Op Fl X Ar exclude-list 60.Ek 61.Sh DESCRIPTION 62The 63.Nm 64utility compares the file hierarchy rooted in the current directory against a 65specification read from the standard input. 66Messages are written to the standard output for any files whose 67characteristics do not match the specifications, or which are 68missing from either the file hierarchy or the specification. 69.Pp 70The options are as follows: 71.Bl -tag -width flag 72.It Fl L 73Follow all symbolic links in the file hierarchy. 74.It Fl P 75Do not follow symbolic links in the file hierarchy, instead consider 76the symbolic link itself in any comparisons. 77This is the default. 78.It Fl U 79Modify the owner, group, permissions, and modification time of existing 80files to match the specification and create any missing directories or 81symbolic links. 82User, group and permissions must all be specified for missing directories 83to be created. 84Corrected mismatches are not considered errors. 85.It Fl c 86Print a specification for the file hierarchy to the standard output. 87.It Fl d 88Ignore everything except directory type files. 89.It Fl e 90Do not complain about files that are in the file hierarchy, but not in the 91specification. 92.It Fl i 93Indent the output 4 spaces each time a directory level is descended when 94create a specification with the 95.Fl c 96option. 97This does not affect either the /set statements or the comment before each 98directory. 99It does however affect the comment before the close of each directory. 100.It Fl n 101Do not emit pathname comments when creating a specification. 102Normally 103a comment is emitted before each directory and before the close of that 104directory when using the 105.Fl c 106option. 107.It Fl q 108Quiet mode. 109Do not complain when a 110.Dq missing 111directory cannot be created because it already exists. 112This occurs when the directory is a symbolic link. 113.It Fl r 114Remove any files in the file hierarchy that are not described in the 115specification. 116.It Fl u 117Same as 118.Fl U 119except a status of 2 is returned if the file hierarchy did not match 120the specification. 121.It Fl w 122Make some errorconditions non-fatal warnings. 123.It Fl x 124Do not descend below mount points in the file hierarchy. 125.It Fl f Ar file 126Read the specification from 127.Ar file , 128instead of from the standard input. 129.Pp 130If this option is specified twice, the two specifications are compared 131to each other rather than to the file hierarchy. 132The specifications be sorted like output generated using 133.Fl c . 134The output format in this case is somewhat remniscent of 135.Xr comm 1 , 136having "in first spec only", "in second spec only", and "different" 137columns, prefixed by zero, one and two TAB characters respectively. 138Each entry in the "different" column occupies two lines, one from each specification. 139.It Fl K Ar keywords 140Add the specified (whitespace or comma separated) 141.Ar keywords 142to the current set of keywords. 143.It Fl k Ar keywords 144Use the ``type'' keyword plus the specified (whitespace or comma separated) 145.Ar keywords 146instead of the current set of keywords. 147.It Fl p Ar path 148Use the file hierarchy rooted in 149.Ar path , 150instead of the current directory. 151.It Fl s Ar seed 152Display a single checksum to the standard error output that represents all 153of the files for which the keyword 154.Cm cksum 155was specified. 156The checksum is seeded with the specified value. 157.It Fl X Ar exclude-list 158The specified file contains 159.Xr fnmatch 3 160patterns matching files to be excluded from 161the specification, one to a line. 162If the pattern contains a 163.Ql \&/ 164character, it will be matched against entire pathnames (relative to 165the starting directory); otherwise, 166it will be matched against basenames only. 167No comments are allowed in 168the 169.Ar exclude-list 170file. 171.El 172.Pp 173Specifications are mostly composed of ``keywords'', i.e., strings 174that specify values relating to files. 175No keywords have default values, and if a keyword has no value set, no 176checks based on it are performed. 177.Pp 178Currently supported keywords are as follows: 179.Bl -tag -width Cm 180.It Cm cksum 181The checksum of the file using the default algorithm specified by 182the 183.Xr cksum 1 184utility. 185.It Cm flags 186The file flags as a symbolic name. 187See 188.Xr chflags 1 189for information on these names. 190If no flags are to be set the string 191.Dq none 192may be used to override the current default. 193.It Cm ignore 194Ignore any file hierarchy below this file. 195.It Cm gid 196The file group as a numeric value. 197.It Cm gname 198The file group as a symbolic name. 199.It Cm md5digest 200The MD5 message digest of the file. 201.It Cm sha1digest 202The 203.Tn FIPS 204160-1 205.Pq Dq Tn SHA-1 206message digest of the file. 207.It Cm sha256digest 208The 209.Tn FIPS 210180-2 211.Pq Dq Tn SHA-256 212message digest of the file. 213.It Cm ripemd160digest 214The 215.Tn RIPEMD160 216message digest of the file. 217.It Cm mode 218The current file's permissions as a numeric (octal) or symbolic 219value. 220.It Cm nlink 221The number of hard links the file is expected to have. 222.It Cm nochange 223Make sure this file or directory exists but otherwise ignore all attributes. 224.It Cm optional 225The file is optional; do not complain about the file if it is 226not in the file hierarchy. 227.It Cm uid 228The file owner as a numeric value. 229.It Cm uname 230The file owner as a symbolic name. 231.It Cm size 232The size, in bytes, of the file. 233.It Cm link 234The file the symbolic link is expected to reference. 235.It Cm time 236The last modification time of the file. 237.It Cm type 238The type of the file; may be set to any one of the following: 239.Pp 240.Bl -tag -width Cm -compact 241.It Cm block 242block special device 243.It Cm char 244character special device 245.It Cm dir 246directory 247.It Cm fifo 248fifo 249.It Cm file 250regular file 251.It Cm link 252symbolic link 253.It Cm socket 254socket 255.El 256.El 257.Pp 258The default set of keywords are 259.Cm flags , 260.Cm gid , 261.Cm mode , 262.Cm nlink , 263.Cm size , 264.Cm link , 265.Cm time , 266and 267.Cm uid . 268.Pp 269There are four types of lines in a specification. 270.Pp 271The first type of line sets a global value for a keyword, and consists of 272the string ``/set'' followed by whitespace, followed by sets of keyword/value 273pairs, separated by whitespace. 274Keyword/value pairs consist of a keyword, followed by an equals sign 275(``=''), followed by a value, without whitespace characters. 276Once a keyword has been set, its value remains unchanged until either 277reset or unset. 278.Pp 279The second type of line unsets keywords and consists of the string 280``/unset'', followed by whitespace, followed by one or more keywords, 281separated by whitespace. 282.Pp 283The third type of line is a file specification and consists of a file 284name, followed by whitespace, followed by zero or more whitespace 285separated keyword/value pairs. 286The file name may be preceded by whitespace characters. 287The file name may contain any of the standard file name matching 288characters (``['', ``]'', ``?'' or ``*''), in which case files 289in the hierarchy will be associated with the first pattern that 290they match. 291.Pp 292Each of the keyword/value pairs consist of a keyword, followed by an 293equals sign (``=''), followed by the keyword's value, without 294whitespace characters. 295These values override, without changing, the global value of the 296corresponding keyword. 297.Pp 298All paths are relative. 299Specifying a directory will cause subsequent files to be searched 300for in that directory hierarchy. 301Which brings us to the last type of line in a specification: a line 302containing only the string 303.Dq Pa ..\& 304causes the current directory 305path to ascend one level. 306.Pp 307Empty lines and lines whose first non-whitespace character is a hash 308mark (``#'') are ignored. 309.Pp 310The 311.Nm 312utility exits with a status of 0 on success, 1 if any error occurred, 313and 2 if the file hierarchy did not match the specification. 314A status of 2 is converted to a status of 0 if the 315.Fl U 316option is used. 317.Sh FILES 318.Bl -tag -width /etc/mtree -compact 319.It Pa /etc/mtree 320system specification directory 321.El 322.Sh EXIT STATUS 323.Ex -std 324.Sh EXAMPLES 325To detect system binaries that have been ``trojan horsed'', it is recommended 326that 327.Nm 328.Fl K 329.Cm sha256digest 330be run on the file systems, and a copy of the results stored on a different 331machine, or, at least, in encrypted form. 332The output file itself should be digested using the 333.Xr sha256 1 334utility. 335Then, periodically, 336.Nm 337and 338.Xr sha256 1 339should be run against the on-line specifications. 340While it is possible for the bad guys to change the on-line specifications 341to conform to their modified binaries, it is believed to be 342impractical for them to create a modified specification which has 343the same SHA-256 digest as the original. 344.Pp 345The 346.Fl d 347and 348.Fl u 349options can be used in combination to create directory hierarchies 350for distributions and other such things; the files in 351.Pa /etc/mtree 352were used to create almost all directories in this 353.Fx 354distribution.
| 32.Dt MTREE 8 33.Os 34.Sh NAME 35.Nm mtree 36.Nd map a directory hierarchy 37.Sh SYNOPSIS 38.Nm 39.Op Fl LPUcdeinqruxw 40.Bk -words 41.Op Fl f Ar spec 42.Ek 43.Bk -words 44.Op Fl f Ar spec 45.Ek 46.Bk -words 47.Op Fl K Ar keywords 48.Ek 49.Bk -words 50.Op Fl k Ar keywords 51.Ek 52.Bk -words 53.Op Fl p Ar path 54.Ek 55.Bk -words 56.Op Fl s Ar seed 57.Ek 58.Bk -words 59.Op Fl X Ar exclude-list 60.Ek 61.Sh DESCRIPTION 62The 63.Nm 64utility compares the file hierarchy rooted in the current directory against a 65specification read from the standard input. 66Messages are written to the standard output for any files whose 67characteristics do not match the specifications, or which are 68missing from either the file hierarchy or the specification. 69.Pp 70The options are as follows: 71.Bl -tag -width flag 72.It Fl L 73Follow all symbolic links in the file hierarchy. 74.It Fl P 75Do not follow symbolic links in the file hierarchy, instead consider 76the symbolic link itself in any comparisons. 77This is the default. 78.It Fl U 79Modify the owner, group, permissions, and modification time of existing 80files to match the specification and create any missing directories or 81symbolic links. 82User, group and permissions must all be specified for missing directories 83to be created. 84Corrected mismatches are not considered errors. 85.It Fl c 86Print a specification for the file hierarchy to the standard output. 87.It Fl d 88Ignore everything except directory type files. 89.It Fl e 90Do not complain about files that are in the file hierarchy, but not in the 91specification. 92.It Fl i 93Indent the output 4 spaces each time a directory level is descended when 94create a specification with the 95.Fl c 96option. 97This does not affect either the /set statements or the comment before each 98directory. 99It does however affect the comment before the close of each directory. 100.It Fl n 101Do not emit pathname comments when creating a specification. 102Normally 103a comment is emitted before each directory and before the close of that 104directory when using the 105.Fl c 106option. 107.It Fl q 108Quiet mode. 109Do not complain when a 110.Dq missing 111directory cannot be created because it already exists. 112This occurs when the directory is a symbolic link. 113.It Fl r 114Remove any files in the file hierarchy that are not described in the 115specification. 116.It Fl u 117Same as 118.Fl U 119except a status of 2 is returned if the file hierarchy did not match 120the specification. 121.It Fl w 122Make some errorconditions non-fatal warnings. 123.It Fl x 124Do not descend below mount points in the file hierarchy. 125.It Fl f Ar file 126Read the specification from 127.Ar file , 128instead of from the standard input. 129.Pp 130If this option is specified twice, the two specifications are compared 131to each other rather than to the file hierarchy. 132The specifications be sorted like output generated using 133.Fl c . 134The output format in this case is somewhat remniscent of 135.Xr comm 1 , 136having "in first spec only", "in second spec only", and "different" 137columns, prefixed by zero, one and two TAB characters respectively. 138Each entry in the "different" column occupies two lines, one from each specification. 139.It Fl K Ar keywords 140Add the specified (whitespace or comma separated) 141.Ar keywords 142to the current set of keywords. 143.It Fl k Ar keywords 144Use the ``type'' keyword plus the specified (whitespace or comma separated) 145.Ar keywords 146instead of the current set of keywords. 147.It Fl p Ar path 148Use the file hierarchy rooted in 149.Ar path , 150instead of the current directory. 151.It Fl s Ar seed 152Display a single checksum to the standard error output that represents all 153of the files for which the keyword 154.Cm cksum 155was specified. 156The checksum is seeded with the specified value. 157.It Fl X Ar exclude-list 158The specified file contains 159.Xr fnmatch 3 160patterns matching files to be excluded from 161the specification, one to a line. 162If the pattern contains a 163.Ql \&/ 164character, it will be matched against entire pathnames (relative to 165the starting directory); otherwise, 166it will be matched against basenames only. 167No comments are allowed in 168the 169.Ar exclude-list 170file. 171.El 172.Pp 173Specifications are mostly composed of ``keywords'', i.e., strings 174that specify values relating to files. 175No keywords have default values, and if a keyword has no value set, no 176checks based on it are performed. 177.Pp 178Currently supported keywords are as follows: 179.Bl -tag -width Cm 180.It Cm cksum 181The checksum of the file using the default algorithm specified by 182the 183.Xr cksum 1 184utility. 185.It Cm flags 186The file flags as a symbolic name. 187See 188.Xr chflags 1 189for information on these names. 190If no flags are to be set the string 191.Dq none 192may be used to override the current default. 193.It Cm ignore 194Ignore any file hierarchy below this file. 195.It Cm gid 196The file group as a numeric value. 197.It Cm gname 198The file group as a symbolic name. 199.It Cm md5digest 200The MD5 message digest of the file. 201.It Cm sha1digest 202The 203.Tn FIPS 204160-1 205.Pq Dq Tn SHA-1 206message digest of the file. 207.It Cm sha256digest 208The 209.Tn FIPS 210180-2 211.Pq Dq Tn SHA-256 212message digest of the file. 213.It Cm ripemd160digest 214The 215.Tn RIPEMD160 216message digest of the file. 217.It Cm mode 218The current file's permissions as a numeric (octal) or symbolic 219value. 220.It Cm nlink 221The number of hard links the file is expected to have. 222.It Cm nochange 223Make sure this file or directory exists but otherwise ignore all attributes. 224.It Cm optional 225The file is optional; do not complain about the file if it is 226not in the file hierarchy. 227.It Cm uid 228The file owner as a numeric value. 229.It Cm uname 230The file owner as a symbolic name. 231.It Cm size 232The size, in bytes, of the file. 233.It Cm link 234The file the symbolic link is expected to reference. 235.It Cm time 236The last modification time of the file. 237.It Cm type 238The type of the file; may be set to any one of the following: 239.Pp 240.Bl -tag -width Cm -compact 241.It Cm block 242block special device 243.It Cm char 244character special device 245.It Cm dir 246directory 247.It Cm fifo 248fifo 249.It Cm file 250regular file 251.It Cm link 252symbolic link 253.It Cm socket 254socket 255.El 256.El 257.Pp 258The default set of keywords are 259.Cm flags , 260.Cm gid , 261.Cm mode , 262.Cm nlink , 263.Cm size , 264.Cm link , 265.Cm time , 266and 267.Cm uid . 268.Pp 269There are four types of lines in a specification. 270.Pp 271The first type of line sets a global value for a keyword, and consists of 272the string ``/set'' followed by whitespace, followed by sets of keyword/value 273pairs, separated by whitespace. 274Keyword/value pairs consist of a keyword, followed by an equals sign 275(``=''), followed by a value, without whitespace characters. 276Once a keyword has been set, its value remains unchanged until either 277reset or unset. 278.Pp 279The second type of line unsets keywords and consists of the string 280``/unset'', followed by whitespace, followed by one or more keywords, 281separated by whitespace. 282.Pp 283The third type of line is a file specification and consists of a file 284name, followed by whitespace, followed by zero or more whitespace 285separated keyword/value pairs. 286The file name may be preceded by whitespace characters. 287The file name may contain any of the standard file name matching 288characters (``['', ``]'', ``?'' or ``*''), in which case files 289in the hierarchy will be associated with the first pattern that 290they match. 291.Pp 292Each of the keyword/value pairs consist of a keyword, followed by an 293equals sign (``=''), followed by the keyword's value, without 294whitespace characters. 295These values override, without changing, the global value of the 296corresponding keyword. 297.Pp 298All paths are relative. 299Specifying a directory will cause subsequent files to be searched 300for in that directory hierarchy. 301Which brings us to the last type of line in a specification: a line 302containing only the string 303.Dq Pa ..\& 304causes the current directory 305path to ascend one level. 306.Pp 307Empty lines and lines whose first non-whitespace character is a hash 308mark (``#'') are ignored. 309.Pp 310The 311.Nm 312utility exits with a status of 0 on success, 1 if any error occurred, 313and 2 if the file hierarchy did not match the specification. 314A status of 2 is converted to a status of 0 if the 315.Fl U 316option is used. 317.Sh FILES 318.Bl -tag -width /etc/mtree -compact 319.It Pa /etc/mtree 320system specification directory 321.El 322.Sh EXIT STATUS 323.Ex -std 324.Sh EXAMPLES 325To detect system binaries that have been ``trojan horsed'', it is recommended 326that 327.Nm 328.Fl K 329.Cm sha256digest 330be run on the file systems, and a copy of the results stored on a different 331machine, or, at least, in encrypted form. 332The output file itself should be digested using the 333.Xr sha256 1 334utility. 335Then, periodically, 336.Nm 337and 338.Xr sha256 1 339should be run against the on-line specifications. 340While it is possible for the bad guys to change the on-line specifications 341to conform to their modified binaries, it is believed to be 342impractical for them to create a modified specification which has 343the same SHA-256 digest as the original. 344.Pp 345The 346.Fl d 347and 348.Fl u 349options can be used in combination to create directory hierarchies 350for distributions and other such things; the files in 351.Pa /etc/mtree 352were used to create almost all directories in this 353.Fx 354distribution.
|
355.Sh SEE ALSO 356.Xr chflags 1 , 357.Xr chgrp 1 , 358.Xr chmod 1 , 359.Xr cksum 1 , 360.Xr md5 1 , 361.Xr stat 2 , 362.Xr fts 3 , 363.Xr md5 3 , 364.Xr chown 8 365.Sh HISTORY 366The 367.Nm 368utility appeared in 369.Bx 4.3 Reno . 370The 371.Tn MD5 372digest capability was added in 373.Fx 2.1 , 374in response to the widespread use of programs which can spoof 375.Xr cksum 1 . 376The 377.Tn SHA-1 378and 379.Tn RIPEMD160 380digests were added in 381.Fx 4.0 , 382as new attacks have demonstrated weaknesses in 383.Tn MD5 . 384The 385.Tn SHA-256 386digest was added in 387.Fx 6.0 . 388Support for file flags was added in 389.Fx 4.0 , 390and mostly comes from 391.Nx .
| 366.Sh SEE ALSO 367.Xr chflags 1 , 368.Xr chgrp 1 , 369.Xr chmod 1 , 370.Xr cksum 1 , 371.Xr md5 1 , 372.Xr stat 2 , 373.Xr fts 3 , 374.Xr md5 3 , 375.Xr chown 8 376.Sh HISTORY 377The 378.Nm 379utility appeared in 380.Bx 4.3 Reno . 381The 382.Tn MD5 383digest capability was added in 384.Fx 2.1 , 385in response to the widespread use of programs which can spoof 386.Xr cksum 1 . 387The 388.Tn SHA-1 389and 390.Tn RIPEMD160 391digests were added in 392.Fx 4.0 , 393as new attacks have demonstrated weaknesses in 394.Tn MD5 . 395The 396.Tn SHA-256 397digest was added in 398.Fx 6.0 . 399Support for file flags was added in 400.Fx 4.0 , 401and mostly comes from 402.Nx .
|