Re: suid xterm
On Mon, Mar 30, 1998 at 02:02:23AM -0800, Guy Maor wrote:
> > > Quick question: has there been a discussion of whether a setuid xterm is
> > > a good idea? Is utmp logging worth the perennial xterm security holes?
> >
> > Yes unless you're willing to let other people see what you type and what is
> > displayed on your screen (oops, there goes my credit card number...)
>
> Right. Programs like xterm and rxvt are suid so they can chown your
> pseudo tty, not so they can write to utmp.
That's not a good reason for them to be setuid though: that can be done in a
wrapper. There's one such wrapper on http://www-uxsup.csx.cam.ac.uk/~pjb1008/
(I can't remember the exact page). If there are no problems with this
approach, and I can't think of any, I'd like to see debian doing this (in
slink).
--
To UNSUBSCRIBE, email to debian-devel-request@lists.debian.org
with a subject of "unsubscribe". Trouble? Contact listmaster@lists.debian.org
Reply to: