konsole security fix (Re: KDE and OpenSSL = Broken)
Kimura Fuyuki
fuyuki at hadaly.org
Fri Feb 23 04:42:12 PST 2007
On Friday 23 February 2007, walt wrote:
>
> Thank you, and welcome to DragonFly! Your program gave Simon enough
> information to fix a long-standing and very important bug. I hope
> you will stay and find more bugs :o)
Thanks for your welcome, and I 'm glad to show you another bug fix. ;)
KDE/DF users can see the following message on their .xsession-errors. This
message is mainly casted by konsole and suggests a security problem. Starting
konsole from konsole is an easy way to see the message.
========
kdecore (KProcess): WARNING: chownpty failed for device /dev/ptyp0::/dev/ttyp0
This means the communication can be eavesdropped.
========
and patch for kdelibs3.
========
$NetBSD$
--- kdecore/kgrantpty.c.orig 2005-09-10 17:27:12.000000000 +0900
+++ kdecore/kgrantpty.c
@@ -36,7 +36,7 @@
#include <unistd.h>
#include <sys/param.h>
-#if defined(__FreeBSD__)
+#if defined(__FreeBSD__) || defined(__DragonFly__)
# define BSD_PTY_HACK
# include <paths.h>
# include <dirent.h>
=========
Actually this hack fixes the problem, but I don't understand why kpty.cpp and
kgrantpty.c could be so cumbersome. kdesu_pty.cpp seems smarter, though.
pty is not a tty on df/fbsd...?
More information about the Users
mailing list