Openwall GNU/*/Linux - a small security-enhanced Linux distro for servers
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Mon, 20 Jun 2011 15:13:36 +0200
From: Karel Zak <kzak@...hat.com>
To: Ondrej Vasik <ovasik@...hat.com>
Cc: Ludwig Nussel <ludwig.nussel@...e.de>, oss-security@...ts.openwall.com,
        Nicolas Fran├žois <nekral.lists@...il.com>
Subject: Re: /bin/su (was: CVE request -- coreutils -- tty
	hijacking possible in "su" via TIOCSTI ioctl)

On Wed, Jun 15, 2011 at 12:50:47PM +0200, Ondrej Vasik wrote:
> On Wed, 2011-06-15 at 09:49 +0200, Ludwig Nussel wrote:
> > Bernhard Rosenkraenzer wrote:
> > > On Friday, June 10, 2011 11:55 CEST, Ludwig Nussel <ludwig.nussel@...e.de> wrote: 
> > >  
> > > > The issue also reminds me that there are several su implemenations.
> > > > On Fedora and SUSE we have a patched coreutils version, Debian uses
> > > > the one from shadow-utils and then there's also a su from
> > > > SimplePAMApps, used by e.g. Owl. Of course each one has it's own
> > > > quirks and weird features. Does anyone still remember why a
> > > > particular implementation was chosen? :-)
> > > 
> > > 
> > > In Ark Linux, we switched from the coreutils one to the shadow-utils one
> > > about 2 years ago because the shadow-utils one does what we need (incl. PAM
> > > support) without having to port the PAM patch on every new coreutils release.
> > 
> > Upstream coreutils indicated that they consider su in coreutils kind
> > of deprecated, basically only kept for legacy reasons on non-Linux
> > OSes. They would accept the PAM patch though so distros don't need
> > to maintain it.
> > 
> > Is there actually any serious distro that doesn't use PAM though?
> > Those #ifdefs to keep old shadow compatibility makes the code rather
> > ugly and hard to read. Maybe it's time to just rip out the old code
> > and submit a clean, PAM only su to util-linux.

 No problem. I agree with the change.

> For me, having it in coreutils, shadow-utils, SimplePAMApps and possibly
> - in util-linux - could only cause a lot of confusion. Some
> consolidation might be better.

 Some consolidation is necessary for many of your utils. I think that
 a lot code in shadow-utils is currently unnecessary -- with PAM-only
 utils we can probably simplify many things.

> Adding util-linux upstream maintainer to CC.

 Thanks.

    Karel

-- 
 Karel Zak  <kzak@...hat.com>
 http://karelzak.blogspot.com

Powered by blists - more mailing lists

Your e-mail address:

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.