On 2013-01-01, Bryan Gardiner wrote: > On Wed, 2 Jan 2013 02:01:52 +0800 > Analuin Abyssbeholder <[email protected]> wrote: > >> Today I wanted to install nethack and found it is masked: >> >> The following mask changes are necessary to proceed: >> #required by nethack (argument) >> # /usr/portage/profiles/package.mask: >> # Tavis Ormandy <[email protected]> <[email protected]> (21 Mar 2006) >> # masked pending unresolved security issues #125902 >> =games-roguelike/nethack-3.4.3-r1 >> >> Then I googled and view >> https://bugs.gentoo.org/show_bug.cgi?id=125902#c82.
Well, you could have just gone to bugs.gentoo.org and searched for 125902 :-) >> It turned out the bug has been existed for more than six years and is >> related to gentoo's group game policy. So can I just manually install >> nethack as a common user ? > > If you're the only user of your computer, you could also just unmask > the version in Portage. The bug is that any user in the games group > can edit all save files, so if you want to hack your own saves, go > ahead :). Or if you trust all games users. The main problem is not the cheating, but that nethack does not employ any kind of checks on the scores file when reading it, this effectively enables an attack vector where anyone with access to the scores file can exploit vulnerabilities in nethack simply by writing a specially-crafted score file. Nethack just relies on being setgid to a group and installing the scores file as writeable by that group. Unfortunately, that happens to be the very same "games" group Gentoo uses to group users who are allowed to play games, therefore rendering nethack's protection useless. > > Doesn't look like there's any newer version of NetHack out, either. > > Cheers, > Bryan > > -- Nuno Silva (aka njsg) http://njsg.sdf-eu.org/
