From owner-freebsd-audit Thu Dec 7 7:34:30 2000 From owner-freebsd-audit@FreeBSD.ORG Thu Dec 7 07:34:28 2000 Return-Path: Delivered-To: freebsd-audit@freebsd.org Received: from innocence.interface-business.de (innocence.interface-business.de [193.101.57.202]) by hub.freebsd.org (Postfix) with ESMTP id DB64537B401 for ; Thu, 7 Dec 2000 07:34:26 -0800 (PST) Received: from interface-business.de (uucp@localhost) by innocence.interface-business.de with UUCP id QAA36715 for audit@FreeBSD.org; Thu, 7 Dec 2000 16:34:25 +0100 (CET) Received: (from j@localhost) by B7173150.deutschepost.de id QAA14455 for audit@FreeBSD.org; Thu, 7 Dec 2000 16:33:33 +0100 (CET) Date: Thu, 7 Dec 2000 16:33:33 +0100 From: J Wunsch To: audit@FreeBSD.org Subject: [j@ida.interface-business.de: Re: Please review a change to lock(1)] Message-ID: <20001207163333.A14418@B7173150.DeutschePost.de> Reply-To: Joerg Wunsch Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii X-Mailer: Mutt 0.95.4i X-Phone: +49-351-31809-14 X-PGP-Fingerprint: DC 47 E6 E4 FF A6 E9 8F 93 21 E0 7D F9 12 D6 4E Organization: interface business GmbH, Dresden Sender: j@interface-business.de Sender: owner-freebsd-audit@FreeBSD.ORG Precedence: bulk X-Loop: FreeBSD.ORG Kris pointed out to me that i should have sent this to the audit list. Sorry, right now i've sent it to -security, so here it is, just FYI. ----- Forwarded message from J Wunsch ----- Date: Thu, 7 Dec 2000 15:57:50 +0100 From: J Wunsch To: freebsd-security@freebsd.org Subject: Re: Please review a change to lock(1) Message-ID: <20001207155750.E4709@B7173150.DeutschePost.de> Reply-To: Joerg Wunsch References: <20001207115835.V4709@B7173150.DeutschePost.de> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii X-Mailer: Mutt 0.95.4i In-Reply-To: ; from James Wyatt on Thu, Dec 07, 2000 at 08:29:03AM -0600 X-Phone: +49-351-31809-14 X-PGP-Fingerprint: DC 47 E6 E4 FF A6 E9 8F 93 21 E0 7D F9 12 D6 4E Organization: interface business GmbH, Dresden Status: RO Content-Length: 1449 Lines: 49 As James Wyatt wrote: > Maybe you could see if it's PPID becomes 1 as init inherits it as an > orphan from the dead parent process. I would *definately* syslog the error > as a simple error *could* be an attempt to trick lock. Some programs > deserve paranoia due to their use and level of users' blind trust. - Jy@ OK, point taken, new suggestion. (Btw., please leave me in the Cc list when replying, i'm not subscribed to -security.) Index: lock.c =================================================================== RCS file: /home/ncvs/src/usr.bin/lock/lock.c,v retrieving revision 1.8 diff -u -r1.8 lock.c --- lock.c 1999/10/12 13:53:30 1.8 +++ lock.c 2000/12/07 14:54:48 @@ -61,6 +61,7 @@ #include #include #include +#include #include #include #include @@ -189,7 +190,15 @@ for (;;) { (void)printf("Key: "); + errno = 0; if (!fgets(s, sizeof(s), stdin)) { + if (errno == EIO && getppid() == 1) { + /* Our terminal is gone; good-bye. */ + syslog(LOG_NOTICE, + "exiting due to IO error on terminal (UID %d@%s on %s)", + getuid(), ttynam, hostname); + exit(1); + } clearerr(stdin); hi(); continue; -- Joerg Wunsch NIC hdl: JW11-RIPE On the air: DL8DTL See http://www.interface-business.de/~j/ for more information. Some addresses in the headers might be wrong (sorry - I'm not the admin here). ----- End forwarded message ----- -- Joerg Wunsch NIC hdl: JW11-RIPE On the air: DL8DTL See http://www.interface-business.de/~j/ for more information. Some addresses in the headers might be wrong (sorry - I'm not the admin here). To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-audit" in the body of the message