Ticket #22 (new defect) — at Initial Version

Opened 11 years ago

Last modified 6 years ago

savannah: cons.saver lacking privileges

Reported by: slavazanko Owned by:
Priority: minor Milestone: Future Releases
Component: mc-core Version:
Keywords: Cc: zaytsev
Blocked By: Blocking:
Branch state: no branch Votes for changeset:


Original: http://savannah.gnu.org/bugs/?13730

Submitted by:Oswald Buddenhagen <ossi>Submitted on:Mon 11 Jul 2005 04:35:25 PM UTC
Category:SubshellSeverity:3 - Normal
Status:None Privacy:Public
Assigned to:NoneOpen/Closed:Open
Release:current (CVS or snapshot)Operating System:GNU/Linux


Mon 11 Jul 2005 04:35:25 PM UTC, original submission:

this has been discussed to death already, but i've seen no viable 
solution so far, only hack suggestions and general paranoia.
the problem is, that "classical" 'configure && make && su -c make 
install' installations from upstream source have a non-working 
cons.saver, because it lacks access to /dev/vcsa?.
the preferred solution is having a vcsa group which /dev/vcsa? 
belong to and to which cons.saver is set-gid. however, there is no 
portable way across linux distros to accomplish this.
the pragmatic solution is just having cons.saver set-uid root and 
leaving potentially safer variants to distro-specific packages, 
like many other applications in the same situation do. after a 
security audit of the really small cons.saver source this variant 
should be perfectly applicable. 
Note: See TracTickets for help on using tickets.