Date: Mon, 10 Apr 95 14:41:24 MDT
From: terry@cs.weber.edu (Terry Lambert)
To: Harlan.Stenn@pfcs.com (Harlan Stenn)
Cc: jkh@freefall.cdrom.com, kuku@gilberto.physik.rwth-aachen.de, joerg_wunsch@uriah.heep.sax.de, freebsd-current@freefall.cdrom.com
Subject: Re: should su retain ${DISPLAY}
Message-ID: <9504102041.AA25231@cs.weber.edu>
In-Reply-To: <18547.797539154@mumps.pfcs.com> from "Harlan Stenn" at Apr 10, 95 02:39:14 pm
next in thread | previous in thread | raw e-mail | index | archive | help
> Terry> I believe that allowing a root credentialed process to open a > Terry> window on an X termintal without going through the authentication > Terry> protocol once again (this time with the new credentials) > Terry> represents a probable security hole. > > Maybe I'm being dense. Anybody can point the DISPLAY variable wherever > they want. Where is the connection (no pun intended) between passing > the DISPLAY variable and the authentication protocol? None. And that's the point. In the case where it still won't work, there's no reason to set it to the invalid value. In the case that it will work, the value shouldn't be set for security reasons. There never a case where it should be set and will work. Terry Lambert terry@cs.weber.edu --- Any opinions in this posting are my own and not those of my present or previous employers.
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?9504102041.AA25231>