From owner-cvs-all@FreeBSD.ORG  Tue Mar  2 11:52:26 2004
Return-Path: <owner-cvs-all@FreeBSD.ORG>
Delivered-To: cvs-all@freebsd.org
Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125])
	by hub.freebsd.org (Postfix) with ESMTP
	id B8F8416A4CE; Tue,  2 Mar 2004 11:52:26 -0800 (PST)
Received: from smtp.des.no (flood.des.no [217.116.83.31])
	by mx1.FreeBSD.org (Postfix) with ESMTP
	id 75BBB43D31; Tue,  2 Mar 2004 11:52:26 -0800 (PST)
	(envelope-from des@des.no)
Received: by smtp.des.no (Pony Express, from userid 666)
	id EBAC85309; Tue,  2 Mar 2004 20:52:24 +0100 (CET)
Received: from dwp.des.no (des.no [80.203.228.37])
	by smtp.des.no (Pony Express) with ESMTP
	id 64B0D5308; Tue,  2 Mar 2004 20:52:17 +0100 (CET)
Received: by dwp.des.no (Postfix, from userid 2602)
	id DC2EA33C6C; Tue,  2 Mar 2004 20:52:16 +0100 (CET)
To: Peter Schultz <pmes@bis.midco.net>
References: <20040302153831.GK13724@sirius.firepipe.net>
	<200403021553.i22Frvhr030302@green.homeunix.org>
	<20040302161147.GK27008@FreeBSD.org>
	<20040302175511.GD1377@lum.celabo.org>
	<4044D371.7030803@bis.midco.net>
From: des@des.no (Dag-Erling =?iso-8859-1?q?Sm=F8rgrav?=)
Date: Tue, 02 Mar 2004 20:52:16 +0100
In-Reply-To: <4044D371.7030803@bis.midco.net> (Peter Schultz's message of
 "Tue, 02 Mar 2004 12:33:21 -0600")
Message-ID: <xzpd67vrpqn.fsf@dwp.des.no>
User-Agent: Gnus/5.090024 (Oort Gnus v0.24) Emacs/21.3 (berkeley-unix)
MIME-Version: 1.0
Content-Type: text/plain; charset=iso-8859-1
Content-Transfer-Encoding: quoted-printable
X-Spam-Checker-Version: SpamAssassin 2.63 (2004-01-11) on flood.des.no
X-Spam-Level: 
X-Spam-Status: No, hits=0.0 required=5.0 tests=AWL autolearn=no version=2.63
X-Mailman-Approved-At: Wed, 03 Mar 2004 04:38:20 -0800
cc: "Brian F. Feldman" <green@FreeBSD.org>
cc: "Jacques A. Vidrine" <nectar@FreeBSD.org>
cc: Michael Nottebrock <lofi@FreeBSD.org>
cc: Will Andrews <will@csociety.org>
cc: ports-committers@FreeBSD.org
cc: Eivind Eklund <eivind@FreeBSD.org>
cc: cvs-all@FreeBSD.org
cc: cvs-ports@FreeBSD.org
cc: Michael Nottebrock <michaelnottebrock@gmx.net>
Subject: Re: cvs commit: ports/audio/arts Makefile
X-BeenThere: cvs-all@freebsd.org
X-Mailman-Version: 2.1.1
Precedence: list
List-Id: CVS commit messages for the entire tree <cvs-all.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/listinfo/cvs-all>,
	<mailto:cvs-all-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/cvs-all>
List-Post: <mailto:cvs-all@freebsd.org>
List-Help: <mailto:cvs-all-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/cvs-all>,
	<mailto:cvs-all-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Tue, 02 Mar 2004 19:52:26 -0000

Peter Schultz <pmes@bis.midco.net> writes:
> I've always assumed XFree86 to be inherently insecure.  I just found
> these SUID files outside base on my machine:
>
> /usr/X11R6/bin/xterm

needs setuid to record sessions in utmp / wtmp / lastlog.

> /usr/X11R6/bin/xscreensaver

needs setuid to verify your password when you unlock.

> /usr/X11R6/bin/Xwrapper-4

'pkg_delete -r wrapper-\*' (unless you absolutely must use startx)

> /usr/X11R6/libexec/gnome-pty-helper

probably needs setuid for the same reason as xterm.

DES
--=20
Dag-Erling Sm=F8rgrav - des@des.no