Date: Sat, 9 Dec 2000 14:29:28 -0500 (EST) From: rwatson@freebsd.org To: FreeBSD-gnats-submit@freebsd.org Subject: bin/23406: mergemaster should display warning when advising use of MAKEDEV Message-ID: <200012091929.eB9JTST77017@fledge.watson.org> Resent-Message-ID: <200012091930.eB9JU1H77926@freefall.freebsd.org>
next in thread | raw e-mail | index | archive | help
>Number: 23406 >Category: bin >Synopsis: MAKEDEV all should not be used on live systems >Confidential: no >Severity: non-critical >Priority: medium >Responsible: freebsd-bugs >State: open >Quarter: >Keywords: >Date-Required: >Class: sw-bug >Submitter-Id: current-users >Arrival-Date: Sat Dec 09 11:30:00 PST 2000 >Closed-Date: >Last-Modified: >Originator: Robert Watson >Release: FreeBSD 4.2-STABLE i386 >Organization: >Environment: fledge# uname -a FreeBSD fledge.watson.org 4.2-STABLE FreeBSD 4.2-STABLE #0: Fri Nov 24 02:18:30 EST 2000 robert@fledge.watson.org:/usr/obj/data/fbsd-stable/src/sys/FLEDGE i386 >Description: mergemaster, on noticing it merged a change to /dev/MAKEDEV, will suggest to the user that they run MAKEDEV all to recreate devices. However, this is dangerous on multi-user machines, as it resets ownership and permissions on user tty devices so that they are world-readable and writable. This can allow nastiness such as tty spoofing and sniffing, not to mention confusion when the user runs mesg n and discovers they don't own the tty. As such, I'd recommend adding a warning to the mergemaster output recommending that MAKEDEV all not be run on live multi-user systems, and instead only be used in single-user mode or when no risk is involved in resetting these permissions. >How-To-Repeat: mergemaster >Fix: >Release-Note: >Audit-Trail: >Unformatted: To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-bugs" in the body of the message
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?200012091929.eB9JTST77017>