lkml.org 
[lkml]   [1997]   [Feb]   [11]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
Date
From
SubjectLinux and virili (was BOUNCED something, something
-------------< COMMENTS BY Asmodeus >--------------

I dunno if this is your guy's area...if not can u forward this message
to someone on the linux development team that would care bout this
message?

Thanks

-John

----------< END OF COMMENTS BY Asmodeus >----------


On Sun, 9 Feb 1997, W. Reilly Cooley wrote:
[snip]
> 4. It takes advantage of the fact that many neophytes work as root or
> equiv. DO NOT DO THIS! This violates system integrity because it
> makes it easy to do foolish things. Also, be VERY careful about which
> programs are run suid root. doom, quake, etc. (not X versions) are
> common holes because the svgalib requires programs which use it to be
> suid root. Use the X versions.
[snip]

This brings to mind a long standing complaint I have regarding the way the
VGA registers are handled. In an attempt to assure security, the VGA
device is designed so only root can alter the card's registers.
Unfortunately, this forces folks who want or need to do direct graphics to
make their programs suid root. Making a program suid root is, as Mr.
Cooley points out, a huge security risk. So, what started as a feature for
improving system security, ends up leaving it much less secure.

What would be the risks in making the registers writable by anyone who has
the rights to open the VGA device? The only two I can think of are 1) that
someone might be able to peek at the contents of the console screen and 2)
that someone could write a hostile program to block others from using the
console. It seems to me that neither of these risks are as bad as
necessitating the use of suid root programs.

Dan Haskell




*** Game Connection BBS, Portland, OR, USA (503) 698-4200 ***
Telnet gconn.com - IP 204.119.59.98 Voice (503) 698-8244
******************************************************************



\
 
 \ /
  Last update: 2005-03-22 13:38    [W:0.044 / U:0.236 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site