Bug#620304: tmux: Incorrect dropping of privileges allows users to obtain utmp group privileges

2011-04-15 Thread Nicholas Marriott
Thanks, I'm glad to hear you are reconsidering this. I might put it in the tmux FAQ as well. On Wed, Apr 13, 2011 at 09:51:00AM +0200, Karl Ferdinand Ebert wrote: >Hello Nicholas, > >On Wed, Apr 13, 2011 at 12:31 AM, Nicholas Marriott ><[1]nicholas.marri...@gmail.com> wrote: > >

Bug#620304: tmux: Incorrect dropping of privileges allows users to obtain utmp group privileges

2011-04-13 Thread Karl Ferdinand Ebert
Hello Nicholas, On Wed, Apr 13, 2011 at 12:31 AM, Nicholas Marriott < nicholas.marri...@gmail.com> wrote: > Hi > > Not to say I told you so or anything, but this might be a good time to > reiterate that doing this is a bad idea: the minor inconvenience it > prevents (easily avoided by the user wi

Bug#620304: tmux: Incorrect dropping of privileges allows users to obtain utmp group privileges

2011-04-12 Thread Nicholas Marriott
Hi Not to say I told you so or anything, but this might be a good time to reiterate that doing this is a bad idea: the minor inconvenience it prevents (easily avoided by the user with either tmux -S or by setting TMPDIR) is much less of a potential problem than running with elevated privileges. N

Bug#620304: tmux: Incorrect dropping of privileges allows users to obtain utmp group privileges

2011-03-31 Thread Daniel Danner
Package: tmux Version: 1.3-2 Severity: important When running tmux with -S (specify custom socket path), the utmp group privileges will not be dropped but inherited to any shells running within tmux. While /bin/bash gets kind of confused, strangely skips loading /etc/profile, ~/.bashrc etc. and