Return to BSD News archive
Newsgroups: comp.unix.bsd
Path: sserve!manuel.anu.edu.au!munnari.oz.au!spool.mu.edu!uunet!mdisea!uw-coco!nwnexus!wjones
From: wjones@halcyon.com (Warren Jones)
Subject: [386BSD] Running Kermit SUID
Message-ID: <1992Nov17.062542.12140@nwnexus.WA.COM>
Summary: Fix allows Kermit to run SUID, comments solicited.
Keywords: Kermit 386BSD SUID
Sender: sso@nwnexus.WA.COM (System Security Officer)
Organization: Northwest Nexus Inc. (206) 455-3505
Date: Tue, 17 Nov 1992 06:25:42 GMT
Lines: 64
Has anyone else tried to make Kermit run SUID uucp under 386BSD ?
Here's a fix I had to make to get it working the way I wanted.
I'm using the newly released version 5A(186) from watsun.cc.columbia.edu.
(You can find it in /kermit/bin/cku186.tar.Z.)
This is what seems like the proper setup to me:
chown uucp kermit # uucp owns kermit ...
chown uucp /dev/com* # ... and the serial ports ...
chown uucp /var/spool/uucp # ... and the lock directory.
chmod u+s kermit # Kermit runs SUID uucp
However, I found that on startup, Kermit trys to open /dev/tty
to get the tty modes, and the open() fails when the EUID is uucp.
This happens even though /dev/tty is world read and writeable:
crw-rw-rw- 1 root wheel 1, 0 Nov 16 16:25 /dev/tty
Everything seems to work OK if we make Kermit defer opening
/dev/tty until it's made the EUID the same as the real UID.
A patch follows. Comments are welcome.
In particular, I'm hoping someone can tell me whether this
behavior of 386BSD is a bug or a feature.
BTW, I'm running 386BSD 0.1.24, and haven't installed any
kernel patches.
-------------------------- cut here ----------------------------------
*** Save/ckutio.c Tue Nov 3 10:48:06 1992
--- ckutio.c Mon Nov 16 17:47:05 1992
***************
*** 917,923 ****
--- 917,929 ----
int x;
conbgt(0); /* See if we're in the background */
+ #ifndef __386BSD__
+ /* 386BSD doesn't allow us to open /dev/tty in congm() if the */
+ /* EUID == uucp. It's not clear whether this is a bug or a feature */
+ /* but it seems to work if we defer the call to congm() until */
+ /* after the call to priv_ini() ... see below. */
congm(); /* Get console modes */
+ #endif
signal(SIGALRM,SIG_IGN); /* Ignore alarms */
#ifdef ultrix
***************
*** 939,944 ****
--- 945,955 ----
if (x | 4) fprintf(stderr,"Fatal: C-Kermit setuid to root!\n");
exit(1);
}
+ #ifdef __386BSD__
+ /* If running SUID uucp under 386BSD, we can't open /dev/tty */
+ /* in congm() until after the call to priv_ini(). */
+ congm(); /* Get console modes */
+ #endif
return(0);
}
--
Warren Jones
<wjones@halcyon.com>