Embed Notice

I just found the actual answer to this. /etc/periodic/security/ has two periodic scripts that by default run daily: 100.chksetuid and 110.neggrpperm

by default (/etc/defaults/periodic.conf) these are enabled and configured to run daily. these scripts scan your system for files that have insecure setuid and negative group permissions, using `find`.

the problem is that this gets run *per jail* and if the jails mount large datasets it eats a ton of CPU time for several hours at a time.