id	summary	reporter	owner	description	type	status	priority	milestone	component	version	resolution	keywords	cc	blockedby	blocking	branch_state	votes
22	savannah: cons.saver lacking privileges	slavazanko		"Original: http://savannah.gnu.org/bugs/?13730

||Submitted by:||Oswald Buddenhagen <ossi>||Submitted on:||Mon 11 Jul 2005 04:35:25 PM UTC||
||Category:||Subshell||Severity:||3 - Normal||
||Status:||None	Privacy:||Public||
||Assigned to:||None||Open/Closed:||Open||
||Release:||current (CVS or snapshot)||Operating System:||GNU/Linux||

Discussion:
{{{
Mon 11 Jul 2005 04:35:25 PM UTC, original submission:

this has been discussed to death already, but i've seen no viable 
solution so far, only hack suggestions and general paranoia.
the problem is, that ""classical"" 'configure && make && su -c make 
install' installations from upstream source have a non-working 
cons.saver, because it lacks access to /dev/vcsa?.
the preferred solution is having a vcsa group which /dev/vcsa? 
belong to and to which cons.saver is set-gid. however, there is no 
portable way across linux distros to accomplish this.
the pragmatic solution is just having cons.saver set-uid root and 
leaving potentially safer variants to distro-specific packages, 
like many other applications in the same situation do. after a 
security audit of the really small cons.saver source this variant 
should be perfectly applicable. 
}}}
"	defect	new	minor		mc-core