use of xargs wasn't strictly a security hole, but could lead to fouled-

up results.  xargs should really have an option to automatically
'quote' input.

etc/security

@@ -18,11 +18,11 @@ echo "checking setuid files and devices:"
 
 MP=`mount -t ufs | sed 's;/dev/;&r;' | awk '{ print $3 }'`
 set $MP
-(while test $# -ge 1; do
+ls -lgT `while test $# -ge 1; do
 	mount=$1
 	shift
-	find $mount -xdev -perm -u+s -or -perm -g+s | sort
-done) | xargs ls -lgT > $TMP
+	find $mount -xdev \( -perm -u+s -or -perm -g+s \) | sort
+done` > $TMP
 
 #MP=`mount -t ufs | sed 's;/dev/;&r;' | awk '{ print $1 " " $3 }'`
 #set $MP