Re: [XonX-Users] Xterm SUID?

[John D. P. <joh...@ma...>]

On 23 Dec 2004, at 08:59, Torrey Lyons wrote:


> At 7:08 PM -0800 12/22/04, John Davidorff Pell wrote:
>
>
>> Hi!
>>
>> I've got a few questions:
>> 1) Why is Xterm SUID?
>>
>>
>
> The short answer is so that it can chown the pseudo tty that it uses. 
> The long answer is that it does not absolutely need to do this and in 
> any case there are non-SUID ways to do this. Apple's X11 does not have 
> an SUID xterm and it just fails to chown the tty. The main symptom of 
> this is that if you use "who" you will not see your xterm sessions 
> listed. On the other hand if you open up a bunch of SUID xterm or 
> Terminal.app windows you will see them all listed in who. Terminal.app 
> is not SUID so there is clearly another way to do this. Most OS'es 
> have provided some non-SUID way to do this, but this is not standard. 
> If we knew how to do this on Mac OS X we could have xterm do this 
> instead.

Terminal.app launches /usr/bin/login, which is prolly the best thing to 
do, as it is something that must be SUID anyway, and so should handle 
all the things together that might require that. This has the 
unfortunate side-effect of launching the default login shell... oh, 
wait, that's what its supposed to do. ;-)



>> 2) Shouldn't that be explicitly disabled on Darwin?
>>
>>
> Perhaps. We left it that way since it had always been that way and it 
> does modify behavior if you change it. You can change this yourself by 
> putting the following line in your xc/config/cf/host.def file before 
> you build:
>
> #define InstallXtermSetUID     YES

Do you mean to set this to NO? Thanx, I wasn't sure how to turn that 
off. :-)




>> 3) Shouldn't the default be not-SUID, and systems that require it 
>> explicitly set it to be SUID?
>>
>>
>>
>
> Perhaps, but since the Xserver is also SUID on many platforms it 
> sticks out less than as the only SUID X11 program on Mac OS X.
>
>

SUID binaries are something that I have a pet-peeve about. I think that 
they should never be the default and, where required, are usually 
design-flaws.

Thanx,
JP








----
It's all fun and games 'til someone writes to a NULL pointer!