From owner-freebsd-security@FreeBSD.ORG  Mon Jul 10 15:47:36 2006
Return-Path: <owner-freebsd-security@FreeBSD.ORG>
X-Original-To: freebsd-security@freebsd.org
Delivered-To: freebsd-security@freebsd.org
Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125])
	by hub.freebsd.org (Postfix) with ESMTP id 7EB6816A4DA;
	Mon, 10 Jul 2006 15:47:36 +0000 (UTC)
	(envelope-from mi+kde@aldan.algebra.com)
Received: from aldan.algebra.com (aldan.algebra.com [216.254.65.224])
	by mx1.FreeBSD.org (Postfix) with ESMTP id E88C843D45;
	Mon, 10 Jul 2006 15:47:35 +0000 (GMT)
	(envelope-from mi+kde@aldan.algebra.com)
Received: from aldan.algebra.com (aldan [127.0.0.1])
	by aldan.algebra.com (8.13.6/8.13.6) with ESMTP id k6AFlYiO062987
	(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO);
	Mon, 10 Jul 2006 11:47:34 -0400 (EDT)
	(envelope-from mi+kde@aldan.algebra.com)
Received: from localhost (localhost [[UNIX: localhost]])
	by aldan.algebra.com (8.13.6/8.13.6/Submit) id k6AFlYOl062986;
	Mon, 10 Jul 2006 11:47:34 -0400 (EDT)
	(envelope-from mi+kde@aldan.algebra.com)
From: Mikhail Teterin <mi+kde@aldan.algebra.com>
To: "Simon L. Nielsen" <simon@freebsd.org>, Brian Candler <B.Candler@pobox.com>
Date: Mon, 10 Jul 2006 11:47:33 -0400
User-Agent: KMail/1.9.1
References: <200607072030.01999.mi+mx@aldan.algebra.com>
	<44B25F0A.5040709@iang.org> <20060710141729.GF1101@zaphod.nitro.dk>
In-Reply-To: <20060710141729.GF1101@zaphod.nitro.dk>
X-Face: %UW#n0|w>ydeGt/b@1-.UFP=K^~-:0f#O:D7w<gv/&E-lL7twZCT8B~/PA4|\t$ti+22K">hJ5G_<5143Bb3kOIs9XpX+"V+~$adGP:J|SLieM31VIhqXeLBli"<kcG^EOVihy+z3/UR{6SCQ
MIME-Version: 1.0
Content-Type: text/plain;
  charset="koi8-u"
Content-Transfer-Encoding: 7bit
Content-Disposition: inline
Message-Id: <200607101147.34530@aldan>
X-Mailman-Approved-At: Tue, 11 Jul 2006 03:03:50 +0000
Cc: Brian Candler <B.Candler@pobox.com>,
	Mikhail Teterin <mi+mx@aldan.algebra.com>,
	freebsd-security@freebsd.org, net@freebsd.org, imp@freebsd.org,
	Iang <iang@iang.org>
Subject: Re: strange limitation on rcmd()
X-BeenThere: freebsd-security@freebsd.org
X-Mailman-Version: 2.1.5
Precedence: list
List-Id: "Security issues \[members-only posting\]"
	<freebsd-security.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-security>, 
	<mailto:freebsd-security-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-security>
List-Post: <mailto:freebsd-security@freebsd.org>
List-Help: <mailto:freebsd-security-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-security>, 
	<mailto:freebsd-security-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Mon, 10 Jul 2006 15:47:36 -0000

On Monday 10 July 2006 10:17, Simon L. Nielsen wrote:
= Actually it is, but it would obviously be a stupid idea to do so any
= place where privileged ports are required...

It would be. But where they are NOT required, it is stupid to check the 
geteuid() inside the client's rcmd :-)

Thank you very much for your explanation, Brian, rsh being an SUID is 
something I overlooked.

What I remain upset about, though, is that the rcmdsh(), which is used by 
rcmd() ignores the fd2p parameter making it impossible to capture the 
remote's stderr...

Yours,

	-mi