[PATCH] BZ #15755: CVE-2013-2207: pt_chown tricked into granting access to another users pseudo-terminal

[Markus Trippelsdorf]

On 2013.07.25 at 11:25 -0400, Carlos O'Donell wrote:
> On 07/25/2013 10:07 AM, Markus Trippelsdorf wrote:
> > On 2013.07.19 at 01:55 -0400, Carlos O'Donell wrote:
> >> CVE-2013-2207: pt_chown tricked into granting access to another 
> >> users pseudo-terminal
> > 
> > Just a heads up.
> > 
> > This patch causes Konsole and tmux startup failures on my machine, e.g.:
> >  konsole(364)/kdecore (KPty/K3Process) KPty::open: Can't open a pseudo teletype
> > 
> > To fix this issue I had to remount devpts with gid=5:
> >  mount -o remount,gid=5 /dev/pts/
> > 
> > My original fstab had this entry:
> >  devpts  /dev/pts        devpts      rw,relatime,mode=600   0 0
>  
> That is the expected behaviour. The GNU C Library 2.18 expects you
> to have /dev/pts setup correctly.
> 
> Would an additional explanation in NEWS have helped?

Yes. A short explanation in NEWS would be appreciated.
Because it's not totally obvious how to fix this issue when you first
encounter it. (It took me a couple of google searches).

> I've added notes here:
> http://sourceware.org/glibc/wiki/Release/2.18#Packaging_Changes

Thanks.

-- 
Markus