Bug#537867: Please avoid setgid utmp
Package: xterm
Version: 243-1
Severity: wishlist
Hi
xterm is currently sgid utmp; I would prefer it wouldn't be. The xterm
FAQ says:
Why does $LD_LIBRARY_PATH get reset?
If xterm is running setuid (which is needed on some systems which have
no wrappers for opening pty's and updating utmp), newer systems
automatically set or reset environment variables which are considered
security problems. These include $PATH and $LD_LIBRARY_PATH, since they
affect the choice of which programs are run if not specified via a full
pathname.
...
Modern Unix systems (such as recent Solaris and HPUX versions) do not
require you to run xterm setuid. Some will result in odd malfunctions
if you do this.
In my case HOSTALIASES and LD_LIBRARY_PATH get reset when running
programs which is inconvenient for key bindings launching apps in xterm
as I need to start a shell each time to set these vars.
I don't know whether it's possible to drop this bit in Debian yet, but
I wish we do.
Thanks
--
Loïc Minier
Reply to: