oss-sec mailing list archives
Re: Re: TTY handling when executing code in different lower-privileged context (su, virt containers)
From: "Todd C. Miller" <Todd.Miller () courtesan com>
Date: Tue, 06 Nov 2012 10:06:24 -0500
On Tue, 06 Nov 2012 15:06:57 +0100, Marcus Meissner wrote:
Ludwig Nussel tried to also use pseudo tty, but this gets kind of messy soon, especially if you start with the signal handling required (ctrl-z and ctrl-c over su are supposed to work...).
Using a pseudo tty and still having job control work requires you use an extra process in the new session to be the parent of the command. Otherwise the kernel considers the process group to be an "orphan" and won't deliver SIGTSTP, SIGTTOU, SIGTTIN etc. It does get somewhat messy as you need to catch job control signals from the user's tty and pass them on to the process running in the new pty. This is what sudo does when I/O logging is enabled or the "use_pty" option is specified. Simply using setsid() to create a new session for sudo is not a workable solution as it breaks too many things. For example, using sudo in a pipeline would no longer work properly. - todd
Current thread:
- TTY handling when executing code in different lower-privileged context (su, virt containers) halfdog (Nov 05)
- Re: TTY handling when executing code in different lower-privileged context (su, virt containers) vladz (Nov 06)
- <Possible follow-ups>
- Re: TTY handling when executing code in different lower-privileged context (su, virt containers) David Black (Nov 06)
- Re: Re: TTY handling when executing code in different lower-privileged context (su, virt containers) Marcus Meissner (Nov 06)
- Re: Re: TTY handling when executing code in different lower-privileged context (su, virt containers) Todd C. Miller (Nov 06)
- Re: Re: TTY handling when executing code in different lower-privileged context (su, virt containers) Marcus Meissner (Nov 06)