>> By default, the xs-check script errors if the flag is not there; you >> need to use the --tolerate-nosigs option to get the 'you can do >> anything' behaviour. > > I had to read up on xs-check - it's just a simpler friend of xs-sum . > Would it not be easier and less suprising if both tools had the same > behaviour? We can define that the general concept is that > > if -e /etc/xs-security-on or "--strict" is passed then be strict, > otherwise just check consistency if relevant (xs-sum)
Aha, what I have just implemented differs from this just slightly (due to me not reading/remembering properly): --strict causes xs-sum and xs-check to error if the flag is not set, regardless of any known keys. The way you describe is better. I'm not near a school server, so I haven't been able to test the xs-tools usbmount script. It should be allowing a once-only trusted import of keys, then disallowing imports unless they are signed and security is on. Douglas _______________________________________________ Server-devel mailing list [email protected] http://lists.laptop.org/listinfo/server-devel
