Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Message-Id: <20170629155406.E063617FDA8@rebar.astron.com>
Date: Thu, 29 Jun 2017 11:54:06 -0400
From: christos@...las.com (Christos Zoulas)
To: oss-security@...ts.openwall.com
Subject: Re: TIOCSTI not going away

On Jun 29,  4:23pm, solar@...nwall.com (Solar Designer) wrote:
-- Subject: Re: [oss-security] TIOCSTI not going away

| Maybe Christos could comment on tcsh?

TL;DR: tcsh will not lose functionality if TIOCSTI is gone.

tcsh uses TIOCSTI in the editor e_stuff_char() function which is unbound
by default; not many people know about this or use it. There is also the
old FILEC code from csh (that used TIOCSTI to do file completion with
<ESC>), but that is not compiled in. I should remove it but it is kept
there merely for nostalgia :-)

One can be much stricter though about who is allowed to use TIOCSTI
like I've done for NetBSD (require exact credentials match on the
tty). For example the typical example of root running an unprivileged
installer on NetBSD fails:

# cat installer
#!/bin/sh
whoami
/usr/sbin/sti /dev/tty whoami\\n

# su unprivileged -c ./installer
unprivileged
sti: Cannot simulate terminal input: Operation not permitted
# whoami
root

christos

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.