[84] in linux-security and linux-alert archive
Re: tty permissions
daemon@ATHENA.MIT.EDU (Rik Faith)
Thu Mar 9 17:20:48 1995
Date: Thu, 9 Mar 1995 16:15:57 -0500
From: Rik Faith <faith@cs.unc.edu>
To: linux-security@tarsier.cv.nrao.edu
In-Reply-To: [Jeff Uphoff <juphoff@tarsier.cv.nrao.edu>] Thu 9 Mar 1995 14:01:43 -0500
Reply-To: linux-security@tarsier.cv.nrao.edu
On Thu 9 Mar 1995 14:01:43 -0500,
Jeff Uphoff <juphoff@tarsier.cv.nrao.edu> wrote:
> "MM" == Marek Michalkiewicz <ind43@ci3ux.ci.pwr.wroc.pl> writes:
>
> MM> I see one security problem with the standard util-linux login. When
> MM> the user logs in, the permissions of this user's tty are set to 0622.
> MM> [Explanation as to why this is A Bad Thing.]
This was done this way in util-linux because it is the standard way of
doing things in the unix world. The trade-off seems to be between having a
writable tty when you want 'mesg y' and having a bunch of utilities setgid
to tty (which might, in itself, be a security risk, but these utilities are
fairly simple).
I'll look into changing this for the next util-linux release.
