[6564] in RedHat Linux List
Re: need help setting up minicom under rh4.0
daemon@ATHENA.MIT.EDU (Wojtek Pilorz)
Thu Nov 28 07:15:05 1996
Date: Thu, 28 Nov 1996 13:15:31 +0100 (MET)
From: Wojtek Pilorz <wpilorz@celebris.bdk.lublin.pl>
To: Erik Troan <ewt@redhat.com>, "Michael K. Johnson" <johnsonm@redhat.com>,
Miquel vanSmoorenburg <miquels@cistron.nl>,
Daniel Tasch <taschda@sue.dma.org>
Cc: redhat-list@redhat.com
In-Reply-To: <199611220136.UAA07907@sue.dma.org>
Resent-From: redhat-list@redhat.com
Reply-To: redhat-list@redhat.com
On Thu, 21 Nov 1996, Daniel Tasch wrote:
> Date: Thu, 21 Nov 1996 20:36:52 -0500 (EST)
> From: Daniel Tasch <taschda@sue.dma.org>
> To: redhat-list@redhat.com
> Subject: need help setting up minicom under rh4.0
>
> I could use a little help setting up minicom under rh4.0.
>
> The goal is to allow only users listed in /etc/minicom.users to access the
> modem, and have a personal config file in their home directories with
> their setting. When I commented out the 'ALL' line in minicom.users and
> put in a line with my username, other users were still able to use
> minicom. What am I doing wrong??
>
Nothing wrong, you have just hit a bug in RHL 4.0 distribution. See below.
You could:
1. try to fix it yourself via correcting souce code,
2. wait until a corrected package is released :-)
3. change permissions for minicom to SUID root (and probably remove SGID
uucp); That way /etc/minicom.users should be processed;
(but otherwise you increase you security risks if any hole in minicom
is found)
4. remove SGID without adding SUID bit, and either add users which
can use minicom to uucp, or create another group (say modemgr),
change group of /dev/cua0 (pointed to by symlink /dev/modem,
I suppose) to modemgr.
That way only users placed in the group would have access to minicom;
other would be rejected because minicom would not be able to open the
/dev/modem for writing;
Permissions for /dev/cua0 should be 0660;
[Of course if you use other port than DOS COM1; substitute the proper
device name for /dev/cua0]
>
> --
> Dan Tasch P. O. Box 31768 513-252-7179
> taschda@dmapub.dma.org Dayton, OH 45437
>
>
To the RedHat developers:
minicom is installed in RedHat 4.0 (minicom-1.75-2.i386.rpm) as an
executable with set-group-id to uucp (rather than set-user-id to root,
as in standard minicom distribution).
While this is good for security reasons, this seems not to be expected
by minicom;
Please look at the following lines in minicom.c (line 560 and following):
/* Check this user in the USERFILE */
if (real_uid != 0 && real_uid != eff_uid) {
sprintf(userfile, "%s/minicom.users", LIBDIR);
if ((fp = fopen(userfile, "r")) != (FILE *)0) {
So, if minicom is not installed with SUID bit, minicom.users file is not
opened at all;
I think that the 'if' condition should be changed to:
if (real_uid != 0 && (real_uid != eff_uid || real_gid != eff_gid))
However, I have not analyzed the entire source code, so there might be
similar places elsewhere ...
To the minicom maintainer, Miquel;
Would you consider adding this change to the next minicom release?
I believe, that it is much better to have minicom with set-group-id
rather than set-user-id root...
Best regards to all,
Wojtek Pilorz
wpilorz@bdk.lublin.pl
wpilorz@priam.umcs.lublin.pl
--
PLEASE read the Red Hat FAQ, Tips, Errata and the MAILING LIST ARCHIVES!
________________________________________________________________________
http://www.redhat.com/RedHat-FAQ http://www.redhat.com/RedHat-Errata
http://www.redhat.com/RedHat-Tips http://www.redhat.com/mailing-lists
------------------------------------------------------------------------
To unsubscribe: mail -s unsubscribe redhat-list-request@redhat.com < /dev/null
