bug#24551: who doesn't read what man page says it does, so doesn't work

2016-09-26 Thread L. A. Walsh
coreutils-8.23 x64 manpage says: If FILE is not specified, use /var/run/utmp. /var/log/wtmp as FILE is common. If ARG1 ARG2 given, -m presumed: 'am i' or 'mom likes' are usual. Behavior says: access("/var/run/utmpx", F_OK) = -1 ENOENT (No such file or

bug#24541: runcon tty hijacking via TIOCSTI ioctl

2016-09-26 Thread Paul Eggert
"I don't think we need to fix this for runcon, as it isn't as sandboxing tool like sandbox, and the loss of job control would likely be much more noticeable for runcon." Thanks, closing the debbugs bug report.

bug#24541: runcon tty hijacking via TIOCSTI ioctl

2016-09-26 Thread up201407890
Quoting "Paul Eggert" : Hello, I set the bug report here before I got a response from Paul Moore https://marc.info/?l=selinux=147481004710264=2 "I don't think we need to fix this for runcon, as it isn't as sandboxing tool like sandbox, and the loss of job control would

bug#24541: runcon tty hijacking via TIOCSTI ioctl

2016-09-26 Thread Pádraig Brady
On 25/09/16 12:39, up201407...@alunos.dcc.fc.up.pt wrote: > When executing a program via the runcon utility, the nonpriv session > can escape to the parent session by using the TIOCSTI ioctl to push > characters into the terminal's input buffer, allowing an attacker to > execute arbitrary commands

bug#24541: runcon tty hijacking via TIOCSTI ioctl

2016-09-26 Thread Pádraig Brady
On 25/09/16 12:39, up201407...@alunos.dcc.fc.up.pt wrote: > When executing a program via the runcon utility, the nonpriv session > can escape to the parent session by using the TIOCSTI ioctl to push > characters into the terminal's input buffer, allowing an attacker to > execute arbitrary commands