Add an (off by default) check for negative permissions (where the

group on a object has less permissions that everyone).  These
permissions will not work reliably over NFS if you have more than
14 supplemental groups and are usually not what you mean.

MFC after:	1 week

1 files changed, 8 insertions, 0 deletions

diff --git a/share/man/man5/periodic.conf.5 b/share/man/man5/periodic.conf.5
index a3775d8..3213615 100644
--- a/share/man/man5/periodic.conf.5
+++ b/share/man/man5/periodic.conf.5
@@ -482,6 +482,14 @@ Set to
 .Dq Li YES
 to compare the modes and modification times of setuid executables with
 the previous day's values.
+.It Va daily_status_security_neggrpperm_enable
+.Pq Vt bool
+Set to
+.Dq Li YES
+to check for files where the group of a file has less permissions than
+the world at large.
+When users are in more than 14 supplemental groups these negative
+permissions may not be enforced via NFS shares.
 .It Va daily_status_security_chkmounts_enable
 .Pq Vt bool
 Set to