special revision 1.109 
1#	$NetBSD: special,v 1.109 2007/02/04 08:19:26 elad Exp $
2#	@(#)special	8.2 (Berkeley) 1/23/94
3#
4# This file may be overwritten on upgrades.
5# Put your custom specifications in /etc/mtree/special.local instead.
6# See security.conf(5) for details.
7
8#
9# /etc/security checks:
10#	- All of these are checked if $check_mtree is enabled.
11#	- Files with "nodiff" tags are highlighted if they change.
12#	- Files without "nodiff" or "exclude" tags are displayed
13#	  with diff(1)s if $check_changelist is enabled.
14#
15
16/set uname=root gname=wheel
17
18.				type=dir  mode=0755
19
20./dev				type=dir  mode=0755
21./dev/drum			type=char mode=0640 gname=kmem
22./dev/fd			type=dir  mode=0755 ignore
23./dev/kmem			type=char mode=0640 gname=kmem
24./dev/mem			type=char mode=0640 gname=kmem
25
26./etc				type=dir  mode=0755
27./etc/Distfile			type=file mode=0644 optional
28./etc/amd			type=dir  mode=0755 optional
29./etc/apm			type=dir  mode=0755 optional
30./etc/bluetooth			type=dir  mode=0755
31./etc/bluetooth/btdevctl.conf	type=file mode=0644
32./etc/bluetooth/hosts		type=file mode=0644
33./etc/bluetooth/protocols	type=file mode=0644
34./etc/bootparams		type=file mode=0644 optional
35./etc/bootptab			type=file mode=0644 optional
36./etc/ccd.conf			type=file mode=0644 optional
37./etc/cgd			type=dir  mode=0700 optional
38./etc/cgd/cgd.conf		type=file mode=0600 optional
39./etc/changelist		type=file mode=0644
40./etc/crontab			type=file mode=0644 optional
41./etc/csh.cshrc			type=file mode=0644
42./etc/csh.login			type=file mode=0644
43./etc/csh.logout		type=file mode=0644
44./etc/daily			type=file mode=0644
45./etc/daily.conf		type=file mode=0644
46./etc/daily.local		type=file mode=0644 optional
47./etc/defaultdomain		type=file mode=0644 optional
48./etc/defaults			type=dir  mode=0755
49./etc/defaults/daily.conf	type=file mode=0444
50./etc/defaults/monthly.conf	type=file mode=0444
51./etc/defaults/rc.conf		type=file mode=0444
52./etc/defaults/security.conf	type=file mode=0444
53./etc/defaults/weekly.conf	type=file mode=0444
54./etc/dhclient-enter-hooks	type=file mode=0644 optional
55./etc/dhclient-exit-hooks	type=file mode=0644 optional
56./etc/dhclient.conf		type=file mode=0644 optional
57./etc/dhcpd.conf		type=file mode=0644 optional
58./etc/disktab			type=file mode=0644
59./etc/dm.conf			type=file mode=0644
60./etc/dumpdates			type=file mode=0664 gname=operator optional tags=exclude
61./etc/ethers			type=file mode=0644 optional
62./etc/exports			type=file mode=0644 optional
63./etc/floppytab			type=file mode=0644
64./etc/fstab			type=file mode=0644
65./etc/ftpchroot			type=file mode=0644
66./etc/ftpd.conf			type=file mode=0644 optional
67./etc/ftpusers			type=file mode=0644
68./etc/ftpwelcome		type=file mode=0644 optional
69./etc/gateways			type=file mode=0644 optional
70./etc/gettytab			type=file mode=0644
71./etc/group			type=file mode=0644
72./etc/hesiod.conf		type=file mode=0644 optional
73./etc/hosts			type=file mode=0644
74./etc/hosts.allow		type=file mode=0644 optional
75./etc/hosts.deny		type=file mode=0644 optional
76./etc/hosts.equiv		type=file mode=0600 optional
77./etc/hosts.lpd			type=file mode=0644 optional
78./etc/ifaliases			type=file mode=0644 optional
79./etc/inetd.conf		type=file mode=0644
80./etc/ipf.conf			type=file mode=0644 optional
81./etc/ipf6.conf			type=file mode=0644 optional
82./etc/ipnat.conf		type=file mode=0644 optional
83./etc/ipsec.conf		type=file mode=0600 optional tags=nodiff
84./etc/iscsi			type=dir  mode=0755
85./etc/iscsi/auths		type=file mode=0600
86./etc/iscsi/targets		type=file mode=0644
87./etc/ld.so.conf		type=file mode=0644 optional
88./etc/lkm.conf			type=file mode=0644 optional
89./etc/localtime			type=link mode=0755
90./etc/locate.conf		type=file mode=0644 optional
91./etc/login.conf		type=file mode=0644 optional
92./etc/mail			type=dir  mode=0755
93./etc/mail/aliases		type=file mode=0644
94./etc/mail/aliases.db		type=file mode=0644 optional tags=exclude
95./etc/mail.rc			type=file mode=0644
96./etc/mailer.conf		type=file mode=0644
97./etc/man.conf			type=file mode=0644
98./etc/master.passwd		type=file mode=0600 tags=nodiff
99./etc/mk.conf			type=file mode=0644 optional
100./etc/moduli			type=file mode=0444
101./etc/monthly			type=file mode=0644
102./etc/monthly.conf		type=file mode=0644
103./etc/monthly.local		type=file mode=0644 optional
104./etc/mrouted.conf		type=file mode=0644
105./etc/mtree			type=dir  mode=0755
106./etc/mtree/special		type=file mode=0444
107./etc/mtree/special.local	type=file mode=0644 optional
108./etc/mygate			type=file mode=0644 optional
109./etc/mygate6			type=file mode=0644 optional
110./etc/myname			type=file mode=0644 optional
111./etc/named.conf		type=file mode=0644 optional
112./etc/namedb			type=dir  mode=0755
113./etc/netconfig			type=file mode=0644
114./etc/netgroup			type=file mode=0644 optional
115./etc/netgroup.db		type=file mode=0644 optional tags=exclude
116./etc/netstart.local		type=file mode=0644 optional
117./etc/networks			type=file mode=0644
118./etc/newsyslog.conf		type=file mode=0644
119./etc/nsswitch.conf		type=file mode=0644
120./etc/ntp.conf			type=file mode=0644 optional
121./etc/pam.conf			type=file mode=0644 optional
122./etc/pam.d			type=dir  mode=0755
123./etc/pam.d/display_manager	type=file mode=0644
124./etc/pam.d/ftpd		type=file mode=0644
125./etc/pam.d/gdm			type=file mode=0644
126./etc/pam.d/imap		type=file mode=0644
127./etc/pam.d/kde			type=file mode=0644
128./etc/pam.d/login		type=file mode=0644
129./etc/pam.d/other		type=file mode=0644
130./etc/pam.d/passwd		type=file mode=0644
131./etc/pam.d/pop3		type=file mode=0644
132./etc/pam.d/ppp			type=file mode=0644
133./etc/pam.d/rexecd		type=file mode=0644
134./etc/pam.d/rsh			type=file mode=0644
135./etc/pam.d/sshd		type=file mode=0644
136./etc/pam.d/su			type=file mode=0644
137./etc/pam.d/system		type=file mode=0644
138./etc/pam.d/telnetd		type=file mode=0644
139./etc/pam.d/xdm			type=file mode=0644
140./etc/pam.d/xserver		type=file mode=0644
141./etc/passwd			type=file mode=0644
142./etc/passwd.conf		type=file mode=0644 optional
143./etc/phones			type=file mode=0644
144./etc/postfix			type=dir  mode=0755 optional
145./etc/postfix/main.cf		type=file mode=0644 optional
146./etc/postfix/master.cf		type=file mode=0644 optional
147./etc/postfix/postfix-script	type=file mode=0555 optional
148./etc/powerd			type=dir  mode=0755 optional
149./etc/powerd/scripts		type=dir  mode=0755 optional
150./etc/powerd/scripts/acadapter	type=file mode=0555 optional
151./etc/powerd/scripts/lid_switch type=file mode=0555 optional
152./etc/powerd/scripts/power_button type=file mode=0555 optional
153./etc/powerd/scripts/reset_button type=file mode=0555 optional
154./etc/powerd/scripts/sleep_button type=file mode=0555 optional
155./etc/ppp			type=dir  mode=0755 optional
156./etc/ppp/options		type=file mode=0644 optional
157./etc/printcap			type=file mode=0644
158./etc/profile			type=file mode=0644
159./etc/protocols			type=file mode=0644
160./etc/rbootd.conf		type=file mode=0644 optional
161./etc/rc			type=file mode=0644
162./etc/rc.conf			type=file mode=0644
163./etc/rc.d			type=dir  mode=0755
164./etc/rc.d/DAEMON		type=file mode=0555
165./etc/rc.d/LOGIN		type=file mode=0555
166./etc/rc.d/NETWORKING		type=file mode=0555
167./etc/rc.d/SERVERS		type=file mode=0555
168./etc/rc.d/accounting		type=file mode=0555
169./etc/rc.d/altqd		type=file mode=0555
170./etc/rc.d/amd			type=file mode=0555
171./etc/rc.d/apmd			type=file mode=0555
172./etc/rc.d/bootconf.sh		type=file mode=0555
173./etc/rc.d/bootparams		type=file mode=0555
174./etc/rc.d/btconfig		type=file mode=0555
175./etc/rc.d/btdevctl		type=file mode=0555
176./etc/rc.d/bthcid		type=file mode=0555
177./etc/rc.d/ccd			type=file mode=0555
178./etc/rc.d/cgd			type=file mode=0555
179./etc/rc.d/cleartmp		type=file mode=0555
180./etc/rc.d/cron			type=file mode=0555
181./etc/rc.d/dhclient		type=file mode=0555
182./etc/rc.d/dhcpd		type=file mode=0555
183./etc/rc.d/dhcrelay		type=file mode=0555
184./etc/rc.d/dmesg		type=file mode=0555
185./etc/rc.d/downinterfaces	type=file mode=0555
186./etc/rc.d/fixsb		type=file mode=0555
187./etc/rc.d/fsck			type=file mode=0555
188./etc/rc.d/ftpd			type=file mode=0555
189./etc/rc.d/hostapd		type=file mode=0555
190./etc/rc.d/identd		type=file mode=0555
191./etc/rc.d/ifwatchd		type=file mode=0555
192./etc/rc.d/inetd		type=file mode=0555
193./etc/rc.d/ipfilter		type=file mode=0555
194./etc/rc.d/ipfs			type=file mode=0555
195./etc/rc.d/ipmon		type=file mode=0555
196./etc/rc.d/ipnat		type=file mode=0555
197./etc/rc.d/ipsec		type=file mode=0555
198./etc/rc.d/irdaattach		type=file mode=0555
199./etc/rc.d/iscsi_target		type=file mode=0555
200./etc/rc.d/isdnd		type=file mode=0555
201./etc/rc.d/kdc			type=file mode=0555
202./etc/rc.d/ldconfig		type=file mode=0555
203./etc/rc.d/lkm1			type=file mode=0555
204./etc/rc.d/lkm2			type=file mode=0555
205./etc/rc.d/lkm3			type=file mode=0555
206./etc/rc.d/local		type=file mode=0555
207./etc/rc.d/lpd			type=file mode=0555
208./etc/rc.d/mixerctl		type=file mode=0555
209./etc/rc.d/mopd			type=file mode=0555
210./etc/rc.d/motd			type=file mode=0555
211./etc/rc.d/mountall		type=file mode=0555
212./etc/rc.d/mountcritlocal	type=file mode=0555
213./etc/rc.d/mountcritremote	type=file mode=0555
214./etc/rc.d/mountd		type=file mode=0555
215./etc/rc.d/moused		type=file mode=0555
216./etc/rc.d/mrouted		type=file mode=0555
217./etc/rc.d/named		type=file mode=0555
218./etc/rc.d/ndbootd		type=file mode=0555
219./etc/rc.d/network		type=file mode=0555
220./etc/rc.d/newsyslog		type=file mode=0555
221./etc/rc.d/nfsd			type=file mode=0555
222./etc/rc.d/nfslocking		type=file mode=0555
223./etc/rc.d/ntpd			type=file mode=0555
224./etc/rc.d/ntpdate		type=file mode=0555
225./etc/rc.d/perusertmp		type=file mode=0555
226./etc/rc.d/pf			type=file mode=0555
227./etc/rc.d/pf_boot		type=file mode=0555
228./etc/rc.d/pflogd		type=file mode=0555
229./etc/rc.d/poffd		type=file mode=0555
230./etc/rc.d/postfix		type=file mode=0555
231./etc/rc.d/powerd		type=file mode=0555
232./etc/rc.d/ppp			type=file mode=0555
233./etc/rc.d/pwcheck		type=file mode=0555
234./etc/rc.d/quota		type=file mode=0555
235./etc/rc.d/racoon		type=file mode=0555
236./etc/rc.d/raidframe		type=file mode=0555
237./etc/rc.d/raidframeparity	type=file mode=0555
238./etc/rc.d/rarpd		type=file mode=0555
239./etc/rc.d/rbootd		type=file mode=0555
240./etc/rc.d/root			type=file mode=0555
241./etc/rc.d/route6d		type=file mode=0555
242./etc/rc.d/routed		type=file mode=0555
243./etc/rc.d/rpcbind		type=file mode=0555
244./etc/rc.d/rtadvd		type=file mode=0555
245./etc/rc.d/rtclocaltime		type=file mode=0555
246./etc/rc.d/rtsold		type=file mode=0555
247./etc/rc.d/rwho			type=file mode=0555
248./etc/rc.d/savecore		type=file mode=0555
249./etc/rc.d/screenblank		type=file mode=0555
250./etc/rc.d/sdpd			type=file mode=0555
251./etc/rc.d/securelevel		type=file mode=0555
252./etc/rc.d/sshd			type=file mode=0555
253./etc/rc.d/staticroute		type=file mode=0555
254./etc/rc.d/swap1		type=file mode=0555
255./etc/rc.d/swap2		type=file mode=0555
256./etc/rc.d/sysctl		type=file mode=0555
257./etc/rc.d/sysdb		type=file mode=0555
258./etc/rc.d/syslogd		type=file mode=0555
259./etc/rc.d/timed		type=file mode=0555
260./etc/rc.d/tpctl		type=file mode=0555
261./etc/rc.d/ttys			type=file mode=0555
262./etc/rc.d/veriexec		type=file mode=0555
263./etc/rc.d/virecover		type=file mode=0555
264./etc/rc.d/wdogctl		type=file mode=0555
265./etc/rc.d/wpa_supplicant	type=file mode=0555
266./etc/rc.d/wscons		type=file mode=0555
267./etc/rc.d/wsmoused		type=file mode=0555
268./etc/rc.d/xdm			type=file mode=0555
269./etc/rc.d/xfs			type=file mode=0555
270./etc/rc.d/ypbind		type=file mode=0555
271./etc/rc.d/yppasswdd		type=file mode=0555
272./etc/rc.d/ypserv		type=file mode=0555
273./etc/rc.lkm			type=file mode=0644
274./etc/rc.local			type=file mode=0644 optional
275./etc/rc.shutdown		type=file mode=0644
276./etc/rc.shutdown.local		type=file mode=0644 optional
277./etc/rc.subr			type=file mode=0644
278./etc/remote			type=file mode=0644
279./etc/resolv.conf		type=file mode=0644 optional
280./etc/rpc			type=file mode=0644
281./etc/rtadvd.conf		type=file mode=0644 optional
282./etc/security			type=file mode=0644
283./etc/security.conf		type=file mode=0644
284./etc/security.local		type=file mode=0644 optional
285./etc/services			type=file mode=0644
286./etc/shells			type=file mode=0644
287./etc/shosts.equiv		type=file mode=0600 optional
288./etc/skel			type=dir  mode=0755 optional
289./etc/spwd.db			type=file mode=0600 tags=exclude
290./etc/ssh			type=dir  mode=0755 optional
291./etc/ssh/ssh_config		type=file mode=0644 optional
292./etc/ssh/ssh_host_dsa_key	type=file mode=0600 optional tags=nodiff
293./etc/ssh/ssh_host_dsa_key.pub	type=file mode=0644 optional
294./etc/ssh/ssh_host_key		type=file mode=0600 optional tags=nodiff
295./etc/ssh/ssh_host_key.pub	type=file mode=0644 optional
296./etc/ssh/ssh_host_rsa_key	type=file mode=0600 optional tags=nodiff
297./etc/ssh/ssh_host_rsa_key.pub	type=file mode=0644 optional
298./etc/ssh/ssh_known_hosts	type=file mode=0644 optional
299./etc/ssh/ssh_known_hosts2	type=file mode=0644 optional
300./etc/ssh/sshd_config		type=file mode=0644 optional
301./etc/sysctl.conf		type=file mode=0644
302./etc/syslog.conf		type=file mode=0644
303./etc/ttyaction			type=file mode=0644 optional
304./etc/ttys			type=file mode=0644
305./etc/usermgmt.conf		type=file mode=0644 optional
306./etc/weekly			type=file mode=0644
307./etc/weekly.conf		type=file mode=0644
308./etc/weekly.local		type=file mode=0644 optional
309./etc/wscons.conf		type=file mode=0644
310
311./etc/racoon			type=dir  mode=0755 optional
312./etc/racoon/racoon.conf	type=file mode=0644 optional
313./etc/racoon/psk.txt		type=file mode=0600 optional tags=nodiff
314
315./private			type=dir mode=0755 optional
316./private/tmp			type=dir mode=0111 optional ignore
317
318./root				type=dir  mode=0755
319./root/.cshrc			type=file mode=0644
320./root/.klogin			type=file mode=0600 optional
321./root/.login			type=file mode=0644
322./root/.profile			type=file mode=0644
323./root/.rhosts			type=file mode=0600 optional
324./root/.shosts			type=file mode=0600 optional
325./root/.ssh			type=dir  mode=0700 optional
326./root/.ssh/authorized_keys	type=file mode=0600 optional
327./root/.ssh/authorized_keys2	type=file mode=0600 optional
328./root/.ssh/config		type=file mode=0644 optional
329./root/.ssh/id_dsa		type=file mode=0600 optional tags=nodiff
330./root/.ssh/id_dsa.pub		type=file mode=0644 optional
331./root/.ssh/id_rsa		type=file mode=0600 optional tags=nodiff
332./root/.ssh/id_rsa.pub		type=file mode=0644 optional
333./root/.ssh/identity		type=file mode=0600 optional tags=nodiff
334./root/.ssh/identity.pub	type=file mode=0644 optional
335./root/.ssh/known_hosts		type=file mode=0644 optional
336./root/.ssh/known_hosts2	type=file mode=0644 optional
337
338./sbin				type=dir  mode=0755 ignore
339
340./usr				type=dir  mode=0755
341./usr/bin			type=dir  mode=0755 ignore
342./usr/games			type=dir  mode=0755 optional
343./usr/games/hide		type=dir  mode=0750 gname=games ignore optional
344./usr/include			type=dir  mode=0755 ignore
345./usr/lib			type=dir  mode=0755 ignore
346./usr/libdata			type=dir  mode=0755 ignore
347./usr/libexec			type=dir  mode=0755 ignore
348./usr/pkg			type=dir  mode=0755 ignore optional
349./usr/sbin			type=dir  mode=0755 ignore
350./usr/share			type=dir  mode=0755 ignore
351
352./var				type=dir  mode=0755
353./var/account			type=dir  mode=0755
354./var/account/acct		type=file mode=0644 optional tags=exclude
355./var/at			type=dir  mode=0755 ignore
356./var/backups			type=dir  mode=0755 ignore
357./var/chroot			type=dir  mode=0755
358./var/chroot/named		type=dir  mode=0755
359./var/chroot/named/dev		type=dir  mode=0755
360./var/chroot/named/etc		type=dir  mode=0755
361./var/chroot/named/etc/namedb	type=dir  mode=0755
362./var/chroot/named/etc/namedb/cache	type=dir mode=0775 uname=named gname=named
363./var/chroot/named/usr		type=dir  mode=0755
364./var/chroot/named/usr/libexec	type=dir  mode=0755
365./var/chroot/named/var		type=dir  mode=0755
366./var/chroot/named/var/run	type=dir  mode=0775 gname=named
367./var/chroot/named/var/tmp	type=dir  mode=01775 gname=named
368./var/chroot/ntpd		type=dir  mode=0755
369./var/chroot/ntpd/dev		type=dir  mode=0755
370./var/chroot/ntpd/var		type=dir  mode=0755
371./var/chroot/ntpd/var/db	type=dir  mode=0775 gname=ntpd
372./var/chroot/ntpd/var/run	type=dir  mode=0775 gname=ntpd
373./var/chroot/pflogd		type=dir  mode=0755
374./var/chroot/sshd		type=dir  mode=0755
375./var/cron			type=dir  mode=0755
376./var/cron/tabs			type=dir  mode=0700
377./var/cron/tabs/root		type=file mode=0600
378./var/db			type=dir  mode=0755
379./var/log			type=dir  mode=0755
380./var/log/authlog		type=file mode=0600 optional tags=exclude
381./var/log/lastlog		type=file mode=0664 gname=utmp tags=exclude
382./var/log/lastlogx		type=file mode=0664 gname=utmp tags=exclude
383./var/log/wtmp			type=file mode=0664 gname=utmp tags=exclude
384./var/log/wtmpx			type=file mode=0664 gname=utmp tags=exclude
385./var/mail			type=dir  mode=1777 ignore
386./var/preserve			type=dir  mode=0755 ignore
387./var/run			type=dir  mode=0755
388./var/run/utmp			type=file mode=0664 gname=utmp tags=exclude
389./var/run/utmpx			type=file mode=0664 gname=utmp tags=exclude
390./var/spool			type=dir  mode=0755
391./var/spool/ftp			type=dir  mode=0755 optional
392./var/spool/ftp/bin		type=dir  mode=0755 optional
393./var/spool/ftp/bin/ls		type=file mode=0555 optional
394./var/spool/ftp/etc		type=dir  mode=0755 optional
395./var/spool/ftp/etc/group		type=file mode=0644 optional
396./var/spool/ftp/etc/localtime		type=file mode=0644 optional
397./var/spool/ftp/etc/master.passwd	type=file mode=0600 optional
398./var/spool/ftp/etc/passwd		type=file mode=0644 optional
399./var/spool/ftp/hidden		type=dir  mode=0111 ignore optional
400./var/spool/ftp/pub		type=dir  mode=0775 ignore optional
401./var/spool/output		type=dir  mode=0755 ignore
402./var/yp			type=dir  mode=0755
403./var/yp/Makefile		type=file mode=0644 optional
404