[cups.bugs] [MOD] STR #2368: Current setuid() approach of deviced leads to unaccessible devices

[martin.pitt.canonical]

DO NOT REPLY TO THIS MESSAGE.  INSTEAD, POST ANY RESPONSES TO THE LINK BELOW.

[STR New]

scheduler/cups-deviced.c currently seteuid()s to an unprivileged user if
the device node has group or 'other' rights. However, that breaks in the
common case that e. g. /dev/lp0 is root:lp 0660. deviced would seteuid()
so that it runs as lp:root and thus it cannot access the device.

In Debian and Ubuntu we just removed the entire if (!getuid()) {...}
block, and I recommend to do the same upstream. It does not enhance
security at all anyway (since every exploit can easily seteuid() back to
root as well).

Link: http://www.cups.org/str.php?L2368
Version: 1.2.10
-------------- next part --------------
A non-text attachment was scrubbed...
Name: 06_disable_backend_setuid.dpatch
Type: application/octet-stream
Size: 938 bytes
Desc: not available
URL: <http://lists.cups.org/pipermail/cups-devel/attachments/20070430/6b6778a5/attachment.obj>