Debian Bug report logs - #7112
xterm: xterm is setuid root

Full log

🔗 View this message in rfc822 format

Subject: Bug#7112: xterm is unnesesary suid to root
Reply-To: Ian Jackson <[email protected]>, [email protected]
Resent-From: Ian Jackson <[email protected]>
Resent-To: [email protected]
Resent-CC: Stephen Early <[email protected]>
Resent-Date: Sun, 09 Feb 1997 18:45:53 GMT
Resent-Message-ID: <[email protected]>
Resent-Sender: [email protected]
X-Debian-PR-Package: xbase
X-Debian-PR-Keywords: 
X-Loop: [email protected]
Received: via spool by [email protected] id=B7112.85534230816874
          (code B ref 7112); Sun, 09 Feb 1997 18:45:53 GMT
Message-Id: <[email protected]>
Date: Fri, 7 Feb 97 18:59 GMT
From: Ian Jackson <[email protected]>
To: [email protected]

Bo Branten:
> In debian xterm is suid to root. There are no reason for that since it can
> get write access to the neded log files (/var/log/wtmp, /var/log/lastlog
> and /var/run/utmp) with a proper sgid and group write access for the
> log files.

No, xterm needs to be setuid root in order to do tty/pty allocation in
a way that results in a secure session inside the xterm.

When a general solution to this problem is available then xterm should
use it, but until then it should remail setuid root.

I'm retitling this bug and merging it with #988, in which I reported
that `script' is insecure (because it isn't setuid root - and isn't
written to be - and so can't do proper pty allocation).

Ian.

Send a report that this bug log contains spam.