This is the mail archive of the
cygwin-patches@cygwin.com
mailing list for the Cygwin project.
Re: [Patch]: Fixing the PROCESS_DUP_HANDLE security hole (part 1).
- From: Christopher Faylor <cgf at redhat dot com>
- To: cygwin-patches at cygwin dot com
- Date: Mon, 29 Sep 2003 23:14:48 -0400
- Subject: Re: [Patch]: Fixing the PROCESS_DUP_HANDLE security hole (part 1).
- References: <3.0.5.32.20030929215525.0082c4f0@incoming.verizon.net>
- Reply-to: cygwin-patches at cygwin dot com
On Mon, Sep 29, 2003 at 09:55:25PM -0400, Pierre A. Humblet wrote:
>Here is a patch that allows to open master ttys without giving
>full access to the process, at least for access to the ctty.
>
>It works by snooping the ctty pipe handles and duplicating them
>on the cygheap, for use by future opens in descendant processes.
>
>It passes all the tests I tried, but considering my lack of knowledge
>about ttys, everything is possible.
Does it pass doing an "echo > /dev/tty1" where /dev/tty1 is a tty in
another command window?
cgf