Re: safe logging xterm

adambwh.harvard.edu

• Messages sorted by: [ date ][ thread ][ subject ][ author ]
• Next message: Ollivier Robert: "Re: Lotus Notes Encryption Strategies"
• Previous message: Dr. Frederick B. Cohen: "Re: Lotus Notes Encryption Methods"
• In reply to: Margarita Suarez: "safe logging xterm"
• Next in thread: Robert Banz: "Re: safe logging xterm"

Margarita Suarez wrote:

| we have modified xterm to make use of the POSIX saved id where possible;
| otherwise, it uses setreuid() to switch back and forth between user and
| superuser.  we provide enable() and disable() functions which swap the
| euid and ruid so that the running xterm can give up root and take it
| back.

| can anyone see a problem with this fix?

Yes, it leaves setuid on a program that is way too large.  Xterm tends
to be setuid so it can write to utmp.  Thats a bad reason to make a
large program setuid.

Adam

• Next message: Ollivier Robert: "Re: Lotus Notes Encryption Strategies"
• Previous message: Dr. Frederick B. Cohen: "Re: Lotus Notes Encryption Methods"
• In reply to: Margarita Suarez: "safe logging xterm"
• Next in thread: Robert Banz: "Re: safe logging xterm"