[Date Prev][Date Next] [Thread Prev][Thread Next] [Date Index] [Thread Index]

Re: recent gpm DoS issue



On Fri, Jul 28, 2000 at 08:11:12AM +0000, Jim Breton wrote:
> On Thu, Jul 27, 2000 at 11:56:03PM -0800, Ethan Benson wrote:
> > pam_group is only relativly secure if your system is installed and
> > configured a certain way:
> 
> Yup, some of that is mentioned in the documentation... nevertheless, it
> would be a big improvement over making the socket world-writable.

perhaps, or perhaps only trusted users should be granted gid=mouse.  

> Red Hat are using a pam_console module for this, here is an excerpt from
> their advisory:
> 
> "For 6.x, the /dev/gpmctl ownership issue was addressed via the
> pam_console helper mechanism.  This pam module makes devices  
> which need to be accessible via console users owned by them and
> no one else."

pam_console is evil.  its a bigger security hole then gpmctl is. 

besides that pam_console is not secure anyway since one can hold a
file descriptor open on anything except a tty thus retaining access
even when permissions/owners are changed.  (that may not work on a
socket, i don't really know)


> 
> > what is gpmctl actually used for anyway?
> 
> I don't know exactly!  ;)  But here's what the gpm man page says:
> 
>        /dev/gpmctl     A control socket for clients

gee thats descriptive...

> And the file only exists while gpm is running (it's removed when you
> stop gpm) so I am guessing it is the socket through which clients read
> mouse data.

that means you have to play games with the initscript to change its
permissions.. 

-- 
Ethan Benson
http://www.alaska.net/~erbenson/

Attachment: pgpVqg41f9YjZ.pgp
Description: PGP signature


Reply to: