Subject: Bug#3439: Login reconfigures serial port

From: Ian Jackson <[email-masked]>
Date: Mon, 8 Jul 96 02:30 BST

Dale Scheetz writes ("Bug#3439: Login reconfigures serial port"):
> Package: login
> Version: 1.0-5
> 
> Login changes the serial port to one stop bit from the 2 stop bits that
> getty was happy to use. When hard wired to an old dumb terminal, who's
> uart requires 2 stop bits, this causes the password prompt and the
> successive login message to be scrogged by data overruns. The terminal
> user must so an 'stty cstopb' before any further traffic from bash can be
> properly rendered on the terminal.

I need this fixed too.

> A. What security issue is it that makes login want to do this in the first
> place?

I don't think there is a security issue here.  Of course login
shouldn't be setuid root - the idea that you ought to be able to turn
your session into another user like that is horrible.

Ian.

---

From: Guy Maor <[email-masked]>
Date: Tue, 9 Jul 1996 00:48:48 -0500 (CDT)

> your session into another user like that is horrible.

I agree it's horrible, but every other unix I've seen allows it.

login does a vhangup(); that's what's messing with your tty.  I don't
know why the vhangup is necessary but don't feel confident enough to
remove it.  That whole braced-off section (lines 367-387) contains some
extremely bogus code.  The setsid(), for example, always fails because
login is always a process group leader at that point. 

Guy

---

From: Dale Scheetz <[email-masked]>
Date: Wed, 10 Jul 1996 11:20:08 -0400 (EDT)

> login is always a process group leader at that point. 
Well, that's not it! I just took the whole if block containing the vhangup
code out and rebuilt login. The results are still the same: the password
prompt and the login message are scrogged by data overruns. As soon as I
send stty cstopb further output to the terminal is correct.

BTW, the binary target in debian.rules should depend on the build target
and build should depend on clean. This way you can just 'debian.rules
binary' and get a package, even if no build has occured yet.

Thanks,

Dwarf

------------                                          --------------

aka   Dale Scheetz                   Phone:   1 (904) 877-0257
      Flexible Software              Fax:     NONE 
      Black Creek Critters           e-mail:  [email-masked]

------------ If you don't see what you want, just ask --------------