Samu wrote:
> On Sun, Nov 19, 2000 at 06:04:01AM -0900, Ethan Benson wrote:
>
>> does anyone know why debian has /dev/fb* with 622 permissions?
>>
>> the reason i ask is there is a pretty nasty security problem with
>> this, try the following:
>>
>> cat /dev/urandom > /dev/fb0
>>
>> on my system i get a instant kernel panic (2.2.17 from ftp.kernel.org).
>> since the framebuffer devices are world writable anyone with a shell
>> account can crash the system, not nice. (i have a blue G3 using
>> aty128fb)
>>
>> what is broken by setting the permissions on all the framebuffer
>> devices to 0600 ?
>>
>
> well with fbtv or fbi there's a line like this
> (fb = open("/dev/fb0",O_WRONLY,0))
So 0620 might be better, with /dev/fb in group video or a dedicated group.
This is on a SuSE 6.4 system BTW:
crw-rw---- 1 root video 29, 0 Mar 11 2000 /dev/fb0
Michel
--
Earthling Michel Dänzer (MrCooper) \ CS student and free software enthusiast
Debian GNU/Linux (powerpc,i386) user \ member of XFree86 and the DRI project
--
To UNSUBSCRIBE, email to [EMAIL PROTECTED]
with a subject of "unsubscribe". Trouble? Contact [EMAIL PROTECTED]
