Subject: Bug#3836: Minicom checks the /etc/minicom.users file only if euid!=uid

From: Philippe Troin <[email-masked]>
Date: Thu, 18 Jul 1996 22:20:34 -0700

Package: minicom
Version: 1.75-1

I couldn't let minicom observe the /etc/minicom.users restrictions
file.

My cua files were:
crw-rw----   1 root     dialout    5,  64 Dec 31  1969 /dev/cua0
crw-rw----   1 root     dialout    5,  65 Jul 18 21:57 /dev/cua1
crw-rw----   1 root     dialout    5,  66 Dec 31  1969 /dev/cua2
crw-rw----   1 root     dialout    5,  67 Dec 31  1969 /dev/cua3

And I set up minicom to be:
-rwxr-sr-x   1 root     dialout    118865 Jun  8 05:37 /usr/bin/minicom*
as to minimize poptential security problems.

After looking at the sources, I found that the authorization file
is only checked if EUID != UID.
Minicom should either always check the auth file (which doesn't
makes much sense, as anubody can recompile it), or checks for it if
EGID != GID too...

By the way, shouldn't minicom be installed as setgid dialout and the
/etc/minicom.users file be empty (instead of ALL now). It would make
more sense. The current configuration makes minicom potentially
useable by anybody, but nobody except root can access the callout
devices...

Some trivia:

Debian 1.1
Linux tantale 2.0.7 #1 Mon Jul 15 21:40:10 PDT 1996 i486

Package: minicom
Status: install ok installed
Priority: extra
Section: comm
Maintainer: Miquel van Smoorenburg <[email-masked]>
Version: 1.75-1
Recommends: lrzsz
Conffiles:
 /etc/minicom.users 6cbaf5cad1586d129878fb9ff416ec5c
 /etc/minirc.dfl 38385c3c6fe6a9cbad92b201bd72ef67
Description: Clone of the MS-DOS "Telix" communications program.

A trivial patch to check for gids too (I think it's the right
thing):

*** minicom-1.75/src/minicom.c~ Thu Jan 25 01:53:11 1996
--- minicom-1.75/src/minicom.c  Thu Jul 18 22:03:10 1996
***************
*** 558,564 ****
    sprintf(pparfile, "%s/.minirc.%s", homedir, use_port);
  
    /* Check this user in the USERFILE */
!   if (real_uid != 0 && real_uid != eff_uid) {
        sprintf(userfile, "%s/minicom.users", LIBDIR);
        if ((fp = fopen(userfile, "r")) != (FILE *)0) {
                while(fgets(buf, 70, fp) != CNULL && !userok) {
--- 558,564 ----
    sprintf(pparfile, "%s/.minirc.%s", homedir, use_port);
  
    /* Check this user in the USERFILE */
!   if (real_uid != 0 && (real_uid != eff_uid || real_gid != eff_gid)) {
        sprintf(userfile, "%s/minicom.users", LIBDIR);
        if ((fp = fopen(userfile, "r")) != (FILE *)0) {
                while(fgets(buf, 70, fp) != CNULL && !userok) {

Hope that helps.

Phil.

---

From: Miquel van Smoorenburg <[email-masked]>
Date: Fri, 19 Jul 1996 15:35:48 +0200 (MET DST)

> I couldn't let minicom observe the /etc/minicom.users restrictions

Fixed (and mentioned in the manpage) for 1.75-2 or 1.76

Mike.
-- 
  Miquel van    | Cistron Internet Services   --    Alphen aan den Rijn.
  Smoorenburg,  | mailto:[email-masked]          http://www.cistron.nl/
[email-masked] | Tel: +31-172-419445 (Voice) 430979 (Fax) 442580 (Data)