Shouldn't this be reassigned to rsyslog rather than closed? Or to whatever is giving wide open permissions to the log socket?
On Sat, May 2, 2020, 10:06 Debian Bug Tracking System <[email protected]> wrote: > This is an automatic notification regarding your Bug report > which was filed against the bsdutils package: > > #916506: /usr/bin/logger: /usr/bin/logger allows anyone to write to > /var/log/syslog > > It has been closed by Chris Hofstaedtler <[email protected]>. > > Their explanation is attached below along with your original report. > If this explanation is unsatisfactory and you have not received a > better one in a separate message then please contact Chris Hofstaedtler < > [email protected]> by > replying to this email. > > > -- > 916506: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=916506 > Debian Bug Tracking System > Contact [email protected] with problems > > > > ---------- Forwarded message ---------- > From: Chris Hofstaedtler <[email protected]> > To: [email protected] > Cc: > Bcc: > Date: Sat, 2 May 2020 15:56:40 +0200 > Subject: Re: /usr/bin/logger: /usr/bin/logger allows anyone to write to > /var/log/syslog > As explained by Andreas, this is not a bug in util-linux. > > Thanks, > Chris > > > ---------- Forwarded message ---------- > From: Frank Mori Hess <[email protected]> > To: Debian Bug Tracking System <[email protected]> > Cc: > Bcc: > Date: Sat, 15 Dec 2018 02:38:07 -0500 > Subject: /usr/bin/logger: /usr/bin/logger allows anyone to write to > /var/log/syslog > Package: bsdutils > Version: 1:2.29.2-1+deb9u1 > Severity: normal > File: /usr/bin/logger > > Dear Maintainer, > > I was surprised to find that I can write anything I want to > /var/log/syslog using the /usr/bin/logger program as a non-root user. > My user account has no permissions on /var/log/syslog, it can't even > read it. > > -- System Information: > Debian Release: 9.6 > APT prefers stable > APT policy: (500, 'stable') > Architecture: amd64 (x86_64) > Foreign Architectures: i386 > > Kernel: Linux 4.9.0-8-amd64 (SMP w/6 CPU cores) > Locale: LANG=en_US.UTF-8, LC_CTYPE=en_US.UTF-8 (charmap=UTF-8), LANGUAGE= > (charmap=UTF-8) > Shell: /bin/sh linked to /bin/dash > Init: systemd (via /run/systemd/system) > > Versions of packages bsdutils depends on: > ii libc6 2.24-11+deb9u3 > ii libsystemd0 232-25+deb9u6 > > Versions of packages bsdutils recommends: > ii bsdmainutils 9.0.12+nmu1 > > bsdutils suggests no packages. > > -- no debconf information >
