Date: Thu, 27 Dec 2001 17:37:54 -0500 (EST) From: Chris BeHanna <behanna@zbzoom.net> To: <FreeBSD-Security@freebsd.org> Subject: Re: kdm grants ordinary users root access on 4.4-R Message-ID: <20011227173437.T93274-100000@topperwein.dyndns.org> In-Reply-To: <20011215132828.P59641-100000@cithaeron.argolis.org>
next in thread | previous in thread | raw e-mail | index | archive | help
On Sat, 15 Dec 2001, Matt Piechota wrote:
> On Sat, 15 Dec 2001, Raf Schietekat wrote:
>
> > [...kdm gave him a session as root instead of as himself...]
>
> [...snip...]
>
> While kcontrol *does* claim that the user is root, I don't seem to have
> any rootly power to change things, such as the kdm properties. I thinking
> kde2 is having problems with the freebsd passwd, although I don't know
> why. I also haven't figured out why kde won't accept my password to
> unlock the screen saver, of the root password so I *can* modify the kdm
> settings as myself. I've been meaning to peek at the code to see why
> those two bit don't work.
kpasswd needs to be setuid root. There was a window during which
it wasn't, and you installed KDE during that window.
> As for the lack of response, I suppose that if I were very security
> conscious, I wouldn't be running kde (or probably X) in the first place.
> There probably aren't too many people on the list that are running kde. :)
I imagine almost everyone on the list is running X on their
desktops, and that a sizable percentage are running KDE. They also
likely (like me) have their firewalls configured to prevent packets on
ports 6000-6063 from getting out on the external interface (otherwise
every single XEvent--including every single keystroke--can be
sniffed).
Regards,
--
Chris BeHanna
Software Engineer (Remove "bogus" before responding.)
behanna@bogus.zbzoom.net
I was raised by a pack of wild corn dogs.
To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-security" in the body of the message
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20011227173437.T93274-100000>