On Mon, Mar 26, 2012 at 06:27:47PM -0400, Jeffrey Sheinberg wrote:
> On Thu, Feb 03, 2011 at 05:47:46AM -0500, Thomas Dickey wrote:
>
> > Looks like a possible workaround would be to use sudo or other
> > wrapper that holds the setuid behavior.
>
> Hi Thomas,
>
> I tried your above suggestion, in my case I used su like this,
>
> $ su -l jsroot
>
> to get a user "jsroot" login shell.
>
> I have decided it is not appropriate to expect "exec login jsroot" to work,
> even though it seemed to work when /bin/login is setuid 0 and xterm 235-2 was
> installed. I say seemed to work because, actually, the count of logged in
> users on my system was always off by +1 when I used this technique.
sounds good (I wasn't getting far with this, last year, though I'd not
given up).
> Now, when I get a "jsroot" login shell via "su -l jsroot", the following
> situation exists,
>
> # tty
> /dev/pts/2
>
> # logname
> jeff
>
> # var user logname
> export USER='jsroot'
> export LOGNAME='jsroot'
>
> # who | grep pts/2
> jeff pts/2 Mar 26 09:18 (:0.0)
>
> And when I then launch an xterm from this "jsroot" login shell on pts/2,
> I have problems with xterm 261-1 & 276-2, like this,
>
> # tty
> /dev/pts/6
>
> # logname
> root
>
> # var user logname
> export USER='jsroot'
> export LOGNAME='root'
>
> # who | grep pts/6
> root pts/6 Mar 26 16:12 (:0.0)
>
> while xterm 235-2 works correctly, like this,
>
> # tty
> /dev/pts/6
>
> # logname
> jsroot
>
> # var user logname
> export USER='jsroot'
> export LOGNAME='jsroot'
>
> # who | grep pts/6
> jsroot pts/6 Mar 26 16:02 (:0.0)
>
> Note that both lxterminal 0.1.8-2 and xfce4-terminal 0.4.5-1 exibit the same
> (IMO, correct) behavior as xterm 235-2 in this case.
hmm - I'll have to investigate this. It sounds as if you're referring
to the effect of this chunk in main.c:
login_name = NULL;
if (x_getpwuid(screen->uid, &pw)) {
login_name = x_getlogin(screen->uid, &pw);
}
which (is supposed to follow this guideline):
/*
* If the logon-name differs from the value we get by looking in the
* password file, check if it does correspond to the same uid. If so,
* allow that as an alias for the uid.
*/
...so perhaps there's some information that I've discarded before that
point.
--
Thomas E. Dickey <dickey@invisible-island.net>
http://invisible-island.net
ftp://invisible-island.net
Attachment:
signature.asc
Description: Digital signature