Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Mon, 2 Dec 2019 17:50:43 +0000
From: Leonid Isaev <leonid.isaev@...x.com>
To: oss-security@...ts.openwall.com
Subject: Re: virtual consoles

On Mon, Dec 02, 2019 at 06:28:12PM +0100, Solar Designer wrote:
> On Mon, Dec 02, 2019 at 08:56:38AM -0800, Tavis Ormandy wrote:
> > Regardless of your position, this is certainly possible on desktop Linux
> > too, unprivileged users can start a new X server and switch virtual
> > console, even over ssh.
> > 
> > e.g.
> > 
> > $ dbus-send --system --print-reply --dest=org.freedesktop.login1 /org/freedesktop/login1/seat/seat0 org.freedesktop.login1.Seat.SwitchTo uint32:2
> > 
> > (note: object paths may vary by distro, change the 2 to a different
> > number if you're already on VT2, or seat0 if you're on a different seat)
> 
> If this in fact works over SSH and from a user account different than

Yes, it does.

> Why does this functionality even exist?

Because of the same reason why I have dbus on a Spark compute node: systemd :) 

> Maybe simply drop the misfeature?

That would break (at least) systemd user sessions I suppose...

Sincerely,
L.

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.