konsole security fix (Re: KDE and OpenSSL = Broken)

Kimura Fuyuki fuyuki at hadaly.org
Fri Feb 23 04:42:12 PST 2007


On Friday 23 February 2007, walt wrote:
>
> Thank you, and welcome to DragonFly!  Your program gave Simon enough
> information to fix a long-standing and very important bug.  I hope
> you will stay and find more bugs :o)

Thanks for your welcome, and I 'm glad to show you another bug fix. ;)

KDE/DF users can see the following message on their .xsession-errors. This 
message is mainly casted by konsole and suggests a security problem. Starting 
konsole from konsole is an easy way to see the message.

======== 
kdecore (KProcess): WARNING: chownpty failed for device /dev/ptyp0::/dev/ttyp0
This means the communication can be eavesdropped.
======== 

and patch for kdelibs3.

======== 
$NetBSD$

--- kdecore/kgrantpty.c.orig	2005-09-10 17:27:12.000000000 +0900
+++ kdecore/kgrantpty.c
@@ -36,7 +36,7 @@
 #include <unistd.h>
 
 #include <sys/param.h>
-#if defined(__FreeBSD__)
+#if defined(__FreeBSD__) || defined(__DragonFly__)
 #  define BSD_PTY_HACK
 #  include <paths.h>
 #  include <dirent.h>
=========

Actually this hack fixes the problem, but I don't understand why kpty.cpp and 
kgrantpty.c could be so cumbersome. kdesu_pty.cpp seems smarter, though.

pty is not a tty on df/fbsd...?





More information about the Users mailing list