I think adding -b will not fix it (and in fact security_status_diff_flags already contains -b by default). The problem with -b is that it only ignores changes in the amount of white space, but doesn't ignore newly added whitespace.

Using -w would probably fix it.

@phk This is what I was writing you privately...

For reference, this morning I received this abbreviated diff in daily run email:

[lots of files removed]
-1444958 -rwxr-sr-x  1 root     kmem     145608 2024-04-09T01:17:02 /mnt/mail/usr/local/sbin/lsof
-1445084 -rwxr-sr-x  1 root     126       15848 2024-07-06T05:52:29 /mnt/mail/usr/local/sbin/postdrop
-1445088 -rwxr-sr-x  1 root     126        9872 2024-07-06T05:52:29 /mnt/mail/usr/local/sbin/postlog
-1445328 -rwxr-sr-x  1 root     126       19296 2024-07-06T05:52:29 /mnt/mail/usr/local/sbin/postqueue
- 883033 -r-sr-xr--  1 root     operator  12872 2024-12-22T07:50:41 /sbin/mksnap_ffs
- 883052 -r-sr-xr-x  2 root     wheel     61920 2024-12-22T07:50:41 /sbin/ping
- 883052 -r-sr-xr-x  2 root     wheel     61920 2024-12-22T07:50:41 /sbin/ping6
- 883053 -r-sr-xr--  2 root     operator  16016 2024-12-22T07:50:41 /sbin/poweroff
- 883053 -r-sr-xr--  2 root     operator  16016 2024-12-22T07:50:41 /sbin/shutdown
- 484604 -r-sr-xr-x  4 root     wheel     29936 2024-12-22T07:50:41 /usr/bin/at
[lots of files removed]
+883033 -r-sr-xr--  1 root     operator  12872 2024-12-22T07:50:41 /sbin/mksnap_ffs
+883052 -r-sr-xr-x  2 root     wheel     61920 2024-12-22T07:50:41 /sbin/ping
+883052 -r-sr-xr-x  2 root     wheel     61920 2024-12-22T07:50:41 /sbin/ping6
+883053 -r-sr-xr--  2 root     operator  16016 2024-12-22T07:50:41 /sbin/poweroff
+883053 -r-sr-xr--  2 root     operator  16016 2024-12-22T07:50:41 /sbin/shutdown
+484604 -r-sr-xr-x  4 root     wheel     29936 2024-12-22T07:50:41 /usr/bin/at
[lots of files removed]

The root problem is that ls(1) autosizes the inode# column, and I found two possible ways to fix it:

• Use LS_COLWIDTHS=12:0 (millions of millions is enough for everybody!)

• Strip leading spaces before feeding things to diff(1)

I did consider diff -w, and while in theory it should never be able to make any difference, I feel it is going too far given that we are in a security-adjecent area.

And to be honest, I'm not even sure if I think this needs to be fixed...

In D46716#1385799, @michaelo wrote:

The code has changed meanwhile. Please rebase.

Are you seeing something out-of-date? I did rebase the diff when I updated it.

In D46716#1385902, @michaelo wrote:

In D46716#1385899, @allanjude wrote:

In D46716#1385799, @michaelo wrote:

The code has changed meanwhile. Please rebase.

Are you seeing something out-of-date? I did rebase the diff when I updated it.

My bad, I misread the review. All is fine!

There is only one hit:

osipovmi@deblndw011x:~/var/Projekte/freebsd/src (main =)
$ grep -r security_status_diff_flags .
./share/man/man5/periodic.conf.5:.It Va security_status_diff_flags
./usr.sbin/periodic/etc/security/security.functions:    diff ${security_status_diff_flags} ${LOG}/${label}.today \
./usr.sbin/periodic/periodic.conf:security_status_diff_flags="-b -U 0"                  # flags for diff output

why not change security_status_diff_flags directly?

That probably makes more sense, it gives the admin the option to opt out, if they worry that it could miss something.

In D46716#1385902, @michaelo wrote:

why not change security_status_diff_flags directly?

It raises a different question, should daily_diff_flags="-b -U 0" also change to -w?

In D46716#1386358, @allanjude wrote:

In D46716#1385902, @michaelo wrote:

why not change security_status_diff_flags directly?

It raises a different question, should daily_diff_flags="-b -U 0" also change to -w?

I would say so to avoid unnecessary noise and it still can be changed if desired.