Date: Fri, 29 Jan 1999 04:15:19 +0100 (CET) From: Ronald Kuehn <kuehn@rz.tu-clausthal.de> To: FreeBSD-gnats-submit@FreeBSD.ORG Subject: bin/9770: An openpty(3) auxiliary program Message-ID: <199901290315.EAA38998@merlin.rz.tu-clausthal.de>
next in thread | raw e-mail | index | archive | help
>Number: 9770 >Category: bin >Synopsis: An openpty(3) auxiliary program >Confidential: no >Severity: non-critical >Priority: low >Responsible: freebsd-bugs >State: open >Quarter: >Keywords: >Date-Required: >Class: change-request >Submitter-Id: current-users >Arrival-Date: Thu Jan 28 19:20:01 PST 1999 >Closed-Date: >Last-Modified: >Originator: Ronald Kuehn >Release: FreeBSD 3.0-STABLE i386 >Organization: TU Clausthal, Computing Center >Environment: Patches are for 4.0-CURRENT sources as of about Jan 24 1999. >Description: This is a simple implementation of an auxiliary program for openpty(3). It sets the owner, group and mode of pseudo terminals if the caller of openpty(3) is not the super-user. It is modeled after similar programs found in Solaris or Digital Unix. The contained program "/usr/libexec/ttymode" should be installed setuid root. If someone really wants to commit it, it should be carefully reviewed. With these modifications, it should be possible for programs not running with effective userid of the super-user to securely obtain a pseudo terminal. >How-To-Repeat: openpty(3) currently tries to change the owner of an obtained slave pseudo terminal to the owner of the calling process, the group to "tty" (if available) and the mode to 0620. This obviously only works if the caller is running under effective userid of the super-user. >Fix: The files "libutil.diff" and "libexec.diff" contain the patches to src/lib/libutil and src/libexec/Makefile. begin 644 ttymode-changes.tar.gz M'XL("/0AL38"`W1T>6UO9&4M8VAA;F=E<RYT87(`[3II=]M&DOY*_(J*9IY# M2B`)\)(LC1)3)"1A0Y%:`(SLY_AI(*!)X@D$.#ATO+'_^U9U`[PD.]D-I>SN M8\<1@3[J[*ZN`TGR.`U=5G8F=C!F<?7-"S1H*/O-)KP!:LK:;_8"K5:S4:LI MBJ("J+5:8_\---^\0DOCQ(X`WD1AF'QOWOV$,?_-_[N6K.G?]V[8`W,JKC<: M;0J'JBBM1N.;^E?5>BO3O]IJMO:QI]%J*&]`V>K_Q9L>N.SA$.+(R55?O;!O MV<CSF73\YYMD=$P@8(=03>.HZMS%U>=PR7=2Q)+(8W=>,(8(?V(O#$"MU/<E MVHI03J$<T2O,R2N7R_.7@OKNW4%55:NJ`DKKL*D<UIL%OGIO;V]EUKNJHE9K M[T!1#IO[A\VZ]/X]E)OR/NS1G_?O)3"')UW=."[8290&<(/[8N:"$TYC.T%6 M\)1$+HRH;\R2?OM"H]_D$7Z3H#!%1+?L$::W`4L\%P)[RMSRPXA%$!$@EUC# MH7$4IC-\1A&X?&'DAV,OP.&94XG^E8:)G3WC[DRRQS1F49P]W]N^3RO+!7J- M9Y']B"/QQ(7$]F_Q+R<P31W\^Y`PA/PX>QA%TMYWYV?&X)EU($'%&\$/+LHQ M8&ZQ/[@VM7[WHJWW2KG$]HZGMN=7_-"Q?8BG"%UZLVW_]^Q_FJ`67]'^H\E? MLO_-!MG_?:6VM?^O;_]S]5=GR6.E_L(7P"JR;]X`K94+H`6"-#+^_(EL^GY5 MJ55K-5";A\K!85TMT"HR_/,9<ZM?.ZRU#A656_V6(K=@#__BI4&&/V*V2\AM M-'OWD9?0\\TC)!,&X7W`(IF/C,)H?92;<S&:A!)XP9WM>ZZ=,.QZ!">-(A8D M@/8;PA%?X*,1I<5H*?%QC,;U0T0\A[<,:E"1]G0Q+QN'610Z+([!#5D,09C` MQ+XCX,!&(^8D'KX,]2Y!C],9B\IT5<C2'H&PTP?/]^SHD8",(WLJ[1&RW-0? M2'M>3*01Z8!KD;TIQ^T%9/^QWT8$81!7D,K+F009:78T3J?(%O:>VORBXS)5 MZRJ)<T^M-W.Q$CI^O5W3-5D'670E+)IZ8;SH0&5!`U_*]")NR*8@-GO!L37: MH6).X&1X9DIEZQEQ3?%P_Q%1(:\01BZ+I/*2$!#8\X(`Z(>D!6_D.39UP;V' M<T,'-0W>2-K[_C`*#-'-6(`,2XA7="#*6^KXSH%T7O-`.M\\D`<K!_(`!&GY M@70R5TRI*N_0M3^L-0YK2H%6Y0?267/#\-0V%;YY&G59Q1.)/RV5;YV_>8'C MIZCJ?\2/<35YG+&X,OEIO=\+G<1_II]\)^K>6^V^MSW>#<OS610%X1J,D1,\ M@3N.9NL@O7%@/T&?N"C,)YT1BG*M,SL&:T`3;\K6)J:!AU#7.O/KFK.#ZT>X M>T9P?=FVSJ\MZ^/%H*MAM_#:5KMAAZL_=\2S,[6SF$VN[6+RTC@>!MKD]!]) MV'/HA.`S2ZZS6454,UD$F?0]<DOH=J)_$<%NUG^$';A&C.++O_%]YKG7V..Y M^2!N/AD(01I3%XJ98X`PIH$`_U(W31Y!$4?9%,%A;_$MC97@^!BM$7SY`CAF MN^Y\1`93/^N<][K9%(1`7HB82)9C:L>W19QS?=(;='Z1(5OU-ER`)8X*2&`: M!?C&R;OW$F=21/KAF)_E8JD$Q)=CH]DOJX>T8AV!J5D7;?.7#+;,V1!,[I;Z MPUZO=/0$#P>G<&C$MYO.:D4N1AF49>(*U^S!2XJJ`$$J]HLK^I=7%,PU)516 M%*I:(F`9%&X.._433L#]!,T(%(M((#)-QPK9)Q$@0T)Q1-1"S%S.;]\"/VO4 MJ^E]RQ#D.F&`-VK*M\;_4$XD#T[*0@@KHN,3KO13[8-N:=VBH+"T,O&*QDRK M;0W-?)S`*?`S_G^8PV%^S)Z"_RKM?>6G@A^'W,`7;>0BX;Y#[.--)(.0,AU[ M=!GNO6"&`13?\+OSJ;MB[A$WBOOOY'=XG]8:LMKD1A$1<U868NP/M+Y5$B,Y M4464P5&AN@MAFM!M1X<#=JM\TE<@%G![EFD!.2.?FI]1A3\F/QZ)ON)=Z+DE M<";H^!1I@DQ1;HKJ+<ET_XYQ='TJGOQLJGFM&T/3^(*_5_GOF7$IU"2(SZ%Q M\8J3\@PMHO./$;,V=TY--D![[W?HFHME!=2R71/(A9KF*)^C^:M01@9">'9\ M-:Z:*[#(M8SK:*]DL`?71O?*$.?F![Z1D1ZAV'Q_X`+Q<"1M/OXSM';W0MML MC/%[^;]:JS[/_[::E/^K\_SO-OY[^69-T/W'?S;>?M,9FG/^EQQ[X;JBY4#? M^6D005%0;N+JI0KH"1V4>#E8$EX[!47<6R<;%+/4#27N\J#/A->#MXAS<&/C ME`5,HHI"'1I?N.H524)4.$0P?7+*1W0DD'C/1SUFY,5X!:>(&/UZ,\1^G(_T M=KVQE]@^#`/OH2+Q@`%O'9L26OG";WA%$$_"U'?AAJ(!W#`^88ZY#0+:.!4) MHZ(XG+(0'2<,(WW_$>_#@.014NIPZB'->''ASP*28T=LE-)4<J[9/7.1N2LO MF2#+@L%Y!!&O+9V%<>S=H+9(#7.>25I1&@044=X3G$7(0Z)#6K/P<RGR0?IB MAH$)0S+"&Q(&;@6A)\CUA&21L"AHB&%G.4.TP]6[LUPTV,F%RC'-;/2*6"P1 MFM4@@Z]\+A6,V"0C1+0N_)*R20#_B&[?1[RC$D;CG[9)Q9?,_Y%&_KKZG]K: MKS?)_BLM=5O_^ZOTGY_(OT;_O/[7V&]M]?]7ZS\;J[Z^_EMJJ[[5__\6_6>_ M%>>%ZC^U_4:N_T:#]%]35+6Q]?]?HU5WRQ+L0B></4;>>))`T2D!Y6?ANSX8 M+FG[/O`E,?JOZ$K>D?\*NS1D,->C9"<Y>AA#D*='Q0_T">,PC1S&>V[0M<2` M@E+M,25"T%^ER@K^AFE"4)8=8!G06:;,/'K2B7#7[SS*R2<36X0(H]#WPWM* M5:/_Z7K<:R8HM&[*DD-Z5BMKI,6\#B!H<BA(X16#B,W]5_LFO*.A3#H$!!LE M]QU*XI"?[B,\`K-`*PI!*S0A4L>WO2D%,`BC]I001+@DD9P0Y---D;B7H04$ MEQDD-W321>"'ZZH4X^%X!%,;8P$/([:%X.]%H,)@F8U\`UCGN@GFX-2Z:AL: MX/.E,?A5[VI=./F(@QJTA];YP(!VOPN=0=\R]).A-3!,^.<_VR;.__%'&N*[ MK/\1M`^7AF::@`OTB\N>CF`0KM'N6[IFRJ#W.[UA5^^?R8!0H#^PH*=?4(X/ MK(%,Z`C0TY4P.(4+S>B<XVO[1._IUD=.T*EN]0G=*1$(EVW#TCO#7MN`RZ%Q M.3`Y-&*KJYN=7EN_T+H50"(0,6B_:GT+S/-VK[?,)OY;X?)$0PK;)ST.BJ-! M+KNZH74L8F?QU$&9(7$]&<Q+K:/3@_9!0T[:QD<Y`VMJ_SG$23A(T+KMB_89 M\E;\':F@0CI#0[L@>E$.YO#$M'1K:&EP-AAT30*%X$W-^%7O:.81]`8F%]C0 MU&1$8K4Y>H2"TL)A?#X9FCJ7F]ZW-,,87EKZH%\B0.>#*Q0,$MO&U5TNXT&? M\XPR&A@?"2[)@ZM`AJMS#?L-$BF76IMD8:+T.A9!6YJ)6%&>UA*ST-?.>OJ9 MUN]H-#H@0%>ZJ9508[I)$W2!^:K]D?,XY.R3KI`V\;BT=66N4=!/H=W]52?B ML\FX#TP]VS.#4X)D#COGF?2S4U#XN^[^7:*<J_1\7>H;U2WI2;5II:[DA4^Z MLE+3<Y6F%1R4QX]7>Q=5)<(KRD<^);"ST@Y:$C0IO"3@W,6>^^DS'$MD+7:( MNYTC*2L'2=5=X">?S%">3,%']C!C3B*JRS=9HL>%411.EU,]_)TL"AHD@I+G M&$#D>I[/N<`)NR?KGB4U;M)Q_`,<E?F6Z[+8B;Q9@A9,@2))+2@]0XX-O%(/ M[F)Z&-#ZG:K+[J@.^O//.Y"7LRC-->)E86?"G-L8XM1Q&'-ED<,*([P'9V1Y MJ:*?PT@$#,0M\M<E@9Q64**(9V9R%M;JUQ4AT.S[`@*A3/6V@LB>'TF\/E?8%<6Y M`FZ?U$D*`NTNS:&GQ0#M#1C%-U2&NSF2))[-)CR4LJY1QKI0$)J:Y_E+N+HP MFN&V3$:D#Q9%,NRDL3UFA_."?B;GWX(=/CVK9&@?KH<F'BOL^BH5:`(<`^=$ M_7PD<"-=/@N*7$E$@ZKP>EX2!<YT5A05E[E*=V0XX+.4T@H2LFIHN#*0/C&9 M+7V+;"X5%$=\2,'^T;S_>Z!P=25.KA$]81TMWA!6-N8%X=(8O7WY(O&:138A M6ET=9<M_,*_Q%CHWBED_B;'T/5J*N391AF/Z$!$Y+/+])`IUO)R&Z\7&@&-> MW!(5KZ7.'$CYIW%T+38026JI"I*5/L2>%U)\IF8SGT75&C'KVS6:)9X&OQQ) M7[>)P%>._PY>)OZK[ZOJ//Y3Z?O_FJ*HV_K/J[3*;SL@T9__;@1(:YX-`7&` M#VX@""0P&X@""<P\#*27/Q\'$I0_'0@2D(U$@AN@)@\%,U`;B07SG;"A:)#O MN(V$@P1I@_$@)VQ#`2'!VF!$2.`V%1(2K,W$A`1I@T$A@=M<5,C9W$Q82*!6 MXL+L1(C(4)C>K@O_80<I'??:@<P-+W8FD']Y=R!5!C'LG$:,G9A=J%<4!&%. M^-=;4J4_S9UG?.;AT;>J[\%Z53?F8,R/_<&EJ9NKH-I1[HOS25W-[!@Z5QZ? M9V5CO.+_A_'ET5P:I[Q`GL6"-X\2?=2;18-0EPA&5ON??WHKPC7^F;+K11C" M^8\HS<L9)^]4[VG(P(D/Y<0>0_G><]$>Y>[^IUDYOBR;GS\IY7=V^>XSE)UP M.K,=-)M(SZ7]S8E2]KG-4[DMK4N>62<^ZWFZ3/.%R#6T`SUSL,HVR/P]^PP8 MQ4!3A;E`?02KEW'[7[!R'4-%>D'_+Z_,O]#W/Z#N[Z_Z?^I^J[7-_[]*^QL` M-T82FNVSXT)N`4RC8\[?*HYTT>X?+-X/I,[@TC+WC@OE*SS$DG2B]\E8'3>: MS::D]TV\H'JGO?:9>5P>Q<YD+$F5><;I)G8KE""J3&^WWW)LV[9MV[9MV[9M =V[9MV[9MV[9MV[9MV[9MV[:]:/LO#?,X+@!0``"J ` end >Release-Note: >Audit-Trail: >Unformatted: To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-bugs" in the body of the message
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?199901290315.EAA38998>