linux-kernel - Re: [RFC][PATCH] fix xconsole.

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <20081217103132.65061c05@lxorguk.ukuu.org.uk>
Date:	Wed, 17 Dec 2008 10:31:32 +0000
From:	Alan Cox <alan@...rguk.ukuu.org.uk>
To:	ebiederm@...ssion.com (Eric W. Biederman)
Cc:	Andrew Morton <akpm@...ux-foundation.org>,
	<linux-kernel@...r.kernel.org>
Subject: Re: [RFC][PATCH] fix xconsole.

> The console messages may only be redirected once, and root may perform
> that initial redirection.  So I don't see why it is a security issue.

I see nothing after your change that stops random users redirecting the
console providing they are "first". Random users should not be able to
hijack the system console stream.

The ancient behaviour is an icky hack for xconsole in a world where
security didn't use to matter.

Alan
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/