Package: tmux Version: 1.3-2 Severity: important
When running tmux with -S (specify custom socket path), the utmp group privileges will not be dropped but inherited to any shells running within tmux. While /bin/bash gets kind of confused, strangely skips loading /etc/profile, ~/.bashrc etc. and also drops the utmp privileges on its own, using /bin/dash, for instance, allows to illustrate the issue: 1. run "SHELL=/bin/sh tmux -S whatever" 2. run "id" inside tmux 3. observe egid=43(utmp) The problem is apparently introduced by 03_proper_socket_handling.diff and 04_dropping_unnecessary_privileges.diff. The incorrectly placed call to setresgid() in is not reached when a custom socket path is used. -- System Information: Debian Release: 6.0.1 APT prefers squeeze-updates APT policy: (500, 'squeeze-updates'), (500, 'stable') Architecture: i386 (x86_64) Kernel: Linux 2.6.32-5-amd64 (SMP w/4 CPU cores) Locale: LANG=en_US.utf8, LC_CTYPE=en_US.utf8 (charmap=UTF-8) Shell: /bin/sh linked to /bin/dash Versions of packages tmux depends on: ii libc6 2.11.2-10 Embedded GNU C Library: Shared lib ii libevent-1.4-2 1.4.13-stable-1 An asynchronous event notification ii libncurses5 5.7+20100313-5 shared libraries for terminal hand tmux recommends no packages. tmux suggests no packages. -- no debconf information -- To UNSUBSCRIBE, email to [email protected] with a subject of "unsubscribe". Trouble? Contact [email protected]
