security hole in tty handling code

Egor Duda
Wed Mar 28 09:22:00 GMT 2001


  currently process owning master side of pty removes all security
protections from itself to allow children duplicate tty pipe handles.
i was feeling a bit- uneasy knowing that any user can call
OpenProcess() for inetd daemon running under LocalSystem account and
WriteProcessMemory() to it.

  so i've written a small program acting as server, which receives
requests from cygwin process wanting to open slave side of tty, checks
if client have needed permissions and duplicates pipe handles for it.
patch sent to cygwin-patches.

  i realize that it's rather substantial change in cygwin
architecture, but i think it's essential one if we want to make cygwin
in multi-user environment.


egor.   icq 5165414 fidonet 2:5020/496.19

More information about the Cygwin-developers mailing list