I started DesireData's build scripts by modifying Miller's 0.39 scripts to make them more like devel_0_39's SCons files except that there are only made for building DesireData and not the standard devel_0_39 branch.
Then I made a few extra changes:
* Tcl doesn't need to be detected, because DesireData doesn't compile with libtcl. The t_*.c files are not used in DesireData because they correspond to features that we already can do in two lines of Tcl since longer than Pd existed.
* I removed the setuid feature because Pd isn't a proper setuid app, as it doesn't make any checks to prevent the user from abusing the access it gets. I don't see why anyone should use this feature. Login as root if you want to login as root.
* Portaudio 18 is no longer supported.
* I'm cleaning up the detection of JACK and other audio stuff. Somehow, some lines about JACK come in 4 or 5 copies in Miller's configure.in, and they look as if they were generated by a script because it really doesn't look like anyone would ever write code like that. Anyway - it's gone now. I'm going to finish the work on this soon.
* to be continued.
_ _ __ ___ _____ ________ _____________ _____________________ ... | Mathieu Bouchard - tél:+1.514.383.3801 - http://artengine.ca/matju | Freelance Digital Arts Engineer, Montréal QC Canada
Hallo, Mathieu Bouchard hat gesagt: // Mathieu Bouchard wrote:
- I removed the setuid feature because Pd isn't a proper setuid app, as it doesn't make any checks to prevent the user from abusing the access it gets. I don't see why anyone should use this feature. Login as root if you want to login as root.
Good idea: I would even suggest that this feature is dropped from Miller's Pd as well (on Linux at least, I don't know other OSses anymore) as there now are much better mechanisms to alleviate priority than running as root, especially the PAM-rtlimits approach. I don't run a setuid-root Pd binary for months now.
However I have believed that Pd *does* drop root priviledges after it has changed its priority. Have I been fooled?
Ciao
On Nov 22, 2006, at 3:37 PM, Frank Barknecht wrote:
Hallo, Mathieu Bouchard hat gesagt: // Mathieu Bouchard wrote:
- I removed the setuid feature because Pd isn't a proper setuid
app, as it doesn't make any checks to prevent the user from abusing the access it gets. I don't see why anyone should use this feature. Login as root if you want to login as root.
Good idea: I would even suggest that this feature is dropped from Miller's Pd as well (on Linux at least, I don't know other OSses anymore) as there now are much better mechanisms to alleviate priority than running as root, especially the PAM-rtlimits approach. I don't run a setuid-root Pd binary for months now.
Yes, sounds like its time to ditch this.
However I have believed that Pd *does* drop root priviledges after it has changed its priority. Have I been fooled?
When I last checked, it stayed running as root on GNU/Linux.
.hc
------------------------------------------------------------------------
Man has survived hitherto because he was too ignorant to know how to realize his wishes. Now that he can realize them, he must either change them, or perish. -William Carlos Williams
Hallo, Hans-Christoph Steiner hat gesagt: // Hans-Christoph Steiner wrote:
On Nov 22, 2006, at 3:37 PM, Frank Barknecht wrote:
However I have believed that Pd *does* drop root priviledges after it has changed its priority. Have I been fooled?
When I last checked, it stayed running as root on GNU/Linux.
Not here: Trying to write a textfile to "/etc/root" fails even with a setuid /usr/bin/pd:
open: error: /etc/root: write failed
Ciao
On Wed, 22 Nov 2006, Frank Barknecht wrote:
However I have believed that Pd *does* drop root priviledges after it has changed its priority. Have I been fooled?
Oh you're right, it actually works almost properly! My apologies!
However, I still can make an external that can regain root privileges:
#include <unistd.h> #include <stdio.h>
void crack_setup (void) { seteuid(0); fopen("/hax0r","w"); }
_ _ __ ___ _____ ________ _____________ _____________________ ... | Mathieu Bouchard - tél:+1.514.383.3801 - http://artengine.ca/matju | Freelance Digital Arts Engineer, Montréal QC Canada
-
Frank Barknecht -
Hans-Christoph Steiner -
Mathieu Bouchard