From owner-cvs-ports@FreeBSD.ORG Tue Oct 11 01:28:04 2011 Return-Path: Delivered-To: cvs-ports@FreeBSD.ORG Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34]) by hub.freebsd.org (Postfix) with ESMTP id 11C3F106564A; Tue, 11 Oct 2011 01:28:04 +0000 (UTC) (envelope-from ache@vniz.net) Received: from vniz.net (vniz.net [194.87.13.69]) by mx1.freebsd.org (Postfix) with ESMTP id 860398FC15; Tue, 11 Oct 2011 01:28:02 +0000 (UTC) Received: from localhost (localhost [127.0.0.1]) by vniz.net (8.14.5/8.14.5) with ESMTP id p9B1S1uK027600; Tue, 11 Oct 2011 05:28:01 +0400 (MSK) (envelope-from ache@vniz.net) Received: (from ache@localhost) by localhost (8.14.5/8.14.5/Submit) id p9B1S0Re027587; Tue, 11 Oct 2011 05:28:00 +0400 (MSK) (envelope-from ache) Date: Tue, 11 Oct 2011 05:27:59 +0400 From: Andrey Chernov To: cvs-ports@FreeBSD.ORG, Eitan Adler , ports-committers@FreeBSD.ORG, cvs-all@FreeBSD.ORG Message-ID: <20111011012758.GA26511@vniz.net> Mail-Followup-To: Andrey Chernov , cvs-ports@FreeBSD.ORG, Eitan Adler , ports-committers@FreeBSD.ORG, cvs-all@FreeBSD.ORG References: <201110101738.p9AHcHUq031559@repoman.freebsd.org> <20111010194330.GA94990@vniz.net> <20111010215854.GA96634@vniz.net> <20111011002607.GE21265@magic.hamla.org> <20111011010644.GA19242@vniz.net> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <20111011010644.GA19242@vniz.net> User-Agent: Mutt/1.5.21 (2010-09-15) Cc: Subject: Re: cvs commit: ports/x11/luit Makefile distinfo ports/x11/luit/files patch-luit.c X-BeenThere: cvs-ports@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: CVS commit messages for the ports tree List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 11 Oct 2011 01:28:04 -0000 On Tue, Oct 11, 2011 at 05:06:45AM +0400, Andrey Chernov wrote: > On Mon, Oct 10, 2011 at 08:26:08PM -0400, Sahil Tandon wrote: > > > It happens only if builded luit port have WITH_SETUID_LUIT set, otherwise > > > you don't notice the bug. > > > > Ah, so it does not actually affect the default packages as built by the > > clusters? > > Yes, default packages are not affected, but building luit non-setuid by > default isn't a good choice in the first place due to this luit(1) quote: > > On systems without SVR4 ("Unix-98") ptys (notably BSD variants), run- > ning luit as an ordinary user will leave the tty world-writable; this > is a security hole, and luit will generate a warning (but still accept > to run). A possible solution is to make luit suid root; Note: this is true for old FreeBSD versions without /dev/pts, i.e. for FreeBSD < 8. Since old versions will die soon, perhaps choosen default isn't so bad. -- http://ache.vniz.net/