On Mon, 19 Nov 2018, David Herrmann wrote: > > Thanks for the patch. I however believe the fix below is more generic, and > > would prefer taking that one in case noone sees any major flaw in that > > I've overlooked. Thanks. > > As Andy rightly pointed out, the credentials check is actually needed. > The scenario here is using a uhid-fd as stdout when executing a > setuid-program. This will possibly end up reading arbitrary memory > from the setuid program and use it as input for the hid-descriptor.
Ah, right, that's a very good point indeed; I've overlooked that (valid) concern in the thread. Thanks for spotting that, Andy. I've now applied Eric's patch. Thanks everybody, -- Jiri Kosina SUSE Labs
