On Fri, 10 May 2013, Tim Connors wrote: > Actually, the other thing you lose (I presuming caused by acting on bug > #628843) is tty resizing by SIGWINCH. ttys are really useful, it turns > out. > > I have shedloads of up-to-date security patched RHEL5/6 machines, and I've > never come across this problem on them. Yep: > rhel6> su -c -u root 'cat /dev/tty' > Password: > asdasda > asdasda > debian-wheezy> su -c -u root 'cat /dev/tty' > Password: > cat: /dev/tty: No such device or address > > Sorry, marking this bug as RC (pity I missed wheezy!), breaks other > software.
As per some comments in #628843, the way this bug was addressed breaks su -c to increase privledges. It also breaks su -c to become a user and execute something interactive. Root isn't going to be doing stupid things and running scripts that have been compromised (if they are, then they've got bigger problems), so what's the problem? (why on earth would root ever su to an untrusted user account?) I think this change should just be backed out, and a prominent warning about the tty exploit placed in the manpage. -- Tim Connors -- To UNSUBSCRIBE, email to debian-bugs-rc-requ...@lists.debian.org with a subject of "unsubscribe". Trouble? Contact listmas...@lists.debian.org
