sudo bug grants arbitrary rlimit privs

2013-12-07 Thread Andres Perera
given a group-allowed command in sudoers, sudo allows escalating to the rlimit privileges of an arbitrary login class by authenticating to a group that the dude is part of. /etc/sudoers: andres ALL=(andres:andres) /bin/sh -c ulimit\ -a Never in the life should this happen: $ id

Re: sudo bug grants arbitrary rlimit privs

2013-12-07 Thread Andres Perera
On Sat, Dec 7, 2013 at 11:58 AM, Todd C. Miller todd.mil...@courtesan.com wrote: On Sat, 07 Dec 2013 10:42:28 -0430, Andres Perera wrote: Previously, the check was a string comparison of username against run_as_default, which is influenced, possibly among other things, by the compile-time

Re: pf user (and probably group) rules don't behave as documented in 5.3

2013-08-14 Thread Andres Perera
the kernel can make identd queries with setenv(remote_port, 123); setenv(local_port, 456); popen(echo $remote_port, $local_port|nc localhost 113|sed 's,.*:,,', r); i have diff to change chroot(1) so that it documents the need: +.Sh +needs nc and sed in the chroot for pf usage or alternatively

Re: queue(3): Unacounted dependency on NULL

2013-03-31 Thread Andres Perera
On Sun, Mar 31, 2013 at 2:46 AM, Philip Guenther guent...@sendmail.com wrote: On Sat, 30 Mar 2013, Andres Perera wrote: freebsd has _null.h ...but their sys/queue.h doesn't include it. There are two questions here: 1) should sys/queue.h be standalone or does it require NULL

Re: queue(3): Unacounted dependency on NULL

2013-03-31 Thread Andres Perera
On Sun, Mar 31, 2013 at 5:09 AM, Mark Kettenis mark.kette...@xs4all.nl wrote: Date: Sun, 31 Mar 2013 00:16:16 -0700 From: Philip Guenther guent...@sendmail.com On Sat, 30 Mar 2013, Andres Perera wrote: freebsd has _null.h ...but their sys/queue.h doesn't include it. There are two

Re: queue(3): Unacounted dependency on NULL

2013-03-31 Thread Andres Perera
the replacement symbol is defined as equal to NULL, e.g., `__null' in some compilers On Sun, Mar 31, 2013 at 12:58 PM, Ted Unangst t...@tedunangst.com wrote: On Sun, Mar 31, 2013 at 12:12, Andres Perera wrote: On Sun, Mar 31, 2013 at 5:09 AM, Mark Kettenis mark.kette...@xs4all.nl c) wouldn't be terribly

Re: queue(3): Unacounted dependency on NULL

2013-03-30 Thread Andres Perera
suggestion but i figured i'd wait until i produced a patch for _null.h in openbsd) On Sat, Mar 30, 2013 at 3:33 AM, Otto Moerbeek o...@drijf.net wrote: On Mon, Mar 18, 2013 at 03:31:29PM -0430, Andres Perera wrote: Various macros in sys/queue.h depend on NULL; however, the header does not define NULL

queue(3): Unacounted dependency on NULL

2013-03-18 Thread Andres Perera
Various macros in sys/queue.h depend on NULL; however, the header does not define NULL, nor does it include another header that fulfills the dependency. diff --git a/share/man/man3/queue.3 b/share/man/man3/queue.3 index c54e932..5a2e30c 100644 --- a/share/man/man3/queue.3 +++

Re: ksh bad PS1 ascii octal to char conversion

2013-03-02 Thread Andres Perera
On Sat, Mar 2, 2013 at 5:13 PM, Philip Guenther guent...@sendmail.com wrote: On Sat, 2 Mar 2013, andre...@zoho.com wrote: --- src/bin/ksh/lex.c 20 Jan 2013 14:47:46 - 1.46 +++ src/bin/ksh/lex.c 2 Mar 2013 18:30:06 - @@ -5,8 +5,8 @@ */ #include sh.h -#include libgen.h

Re: conflicting types for 'getline'

2013-01-02 Thread Andres Perera
On Wed, Jan 2, 2013 at 11:57 AM, Matthew Szudzik mszud...@cmu.edu wrote: How-To-Repeat: Place the program on page 29 of KR in a file named test.c. Or alternatively, place the following program in test.c. #include stdio.h int getline();

Re: dc(1) divide by zero crash

2012-11-05 Thread Andres Perera
On Mon, Nov 5, 2012 at 3:13 PM, Otto Moerbeek o...@drijf.net wrote: On Sun, Nov 04, 2012 at 03:06:14PM -0430, Andres Perera wrote: On Sun, Nov 4, 2012 at 1:41 PM, Otto Moerbeek o...@drijf.net wrote: It's easy to create a trunc function. Yes it will needs scale setting en resetting, but I

Re: dc(1) divide by zero crash

2012-11-04 Thread Andres Perera
On Sun, Nov 4, 2012 at 1:41 PM, Otto Moerbeek o...@drijf.net wrote: It's easy to create a trunc function. Yes it will needs scale setting en resetting, but I do not see that as a problem. On the other hand, being reminded that ^ does not do fractional exponents is very important. is it

Re: dc(1) divide by zero crash

2012-11-03 Thread Andres Perera
On Sat, Nov 3, 2012 at 2:19 PM, andre...@zoho.com wrote: 0^-1 divides by zero, shows random bn warning and kills dc. doesn't happen with other div operators also even after this patch: echo 1/0.1 | bc 10 echo 0.1^-1 | bc dc: big number failure 306b067: Undefined error: 0 gnu bc handles

Re: Building OpenBSD -current from source exits in cpan/Encode

2012-10-08 Thread Andres Perera
you have to prune empty directories from cvs even if you pass the correct flag to co/up, interrupting the update may leave directories in your work copy. it's also worth noting that the deletion of empty directories is the very last task performed by the sync here's my full list of quirks

Re: Improve compatibility of m4

2011-10-25 Thread Andres Perera
solaris doesn't have regexp() macro, nor patpsubst(), nor the rest of macros added so that obsd m4 could be used for autoconf On Tue, Oct 25, 2011 at 7:23 AM, Raimo Niskanen raimo+open...@erix.ericsson.se wrote: On Tue, Oct 25, 2011 at 10:35:53AM +0100, Stuart Henderson wrote: Thanks for the

rt3090 on a HP Mini 210-1035LA isn't initialized correctly and doesn't scan

2010-10-16 Thread Andres Perera
The explanation and everything is below the dmesg. It's important to look at it to understand what's happening first. dmesg - OpenBSD 4.8-current (GENERIC) #232: Tue Sep 7 12:58:39 MDT 2010 dera...@amd64.openbsd.org:/usr/src/sys/arch/amd64/compile/GENERIC RTC BIOS diagnostic