Re: [gentoo-hardened] novice question regarding SU and TTY

[Vieri]

Regarding SU:
my mistake, sorry. It actually does work but I was
doing it stupidly on a user account whose shell was
/bin/false.

Regarding /dev/ttySx:
1) is putting nut in the uucp group safe?
2) is changing the GROUP for ttyS in udev safe?

non-hardened udev rules:

# tty devices
KERNEL=="ttyS[0-9]*",   NAME="tts/%n", SYMLINK+="%k",
GROUP="tty"
KERNEL=="ttyUSB[0-9]*", NAME="tts/USB%n", GROUP="tty",
MODE="0660"

hardened udev rules:

# tty devices
KERNEL=="ttyS[0-9]*",   NAME="%k", SYMLINK="tts/%n",
GROUP="uucp", MODE="0660"
KERNEL=="ttyUSB[0-9]*", NAME="%k",
SYMLINK="tts/USB%n", GROUP="uucp", MODE="0660

Of the two methods I suppose modifying the udev rules
is the safest because I could just redefine ttyS0
only.

Thank you.
  
--- gentoo-hardened-ml-01@××××××.org wrote:

> Changing the perms on /dev/ttyS0 manually will not
> persist between reboots.
> You should change the udev rules in
> /etc/udev/rules.d/ or add "nut" to the
> uucp group in /etc/group.
>
> As for why your su doesn't work, I am not sure.
> Works for me, my root user is
> in the wheel group and the user I su to exists.
>
> On Tuesday, May 8, 2007 07:55, Vieri wrote:
> > --- Vieri <rentorbuy@×××××.com> wrote:
> > > Hi,
> > >
> > > I've recently installed a gentoo box with the
> > > hardend
> > > profile + hardened-sources so I'm new to all
> this.
> > >
> > > I have two basic questions that I can't seem to
> > > answer.
> > >
> > > 1) SU:
> > > on the non-hardened gentoo box I'm used to, I
> can
> > > enter as root and then do a "su username" and a
> > > whoami
> > > shows that username. However, in the hardened
> box,
> > > issuing "su username" doesn't do anything and
> whoami
> > > is still root. I can't see any log messages
> related
> > > to
> > > this. Is this behavior normal?
> > >
> > > 2) TTY:
> > > on my non-hardened gentoo I emerged
> sys-power/nut
> > > which is a UPS monitoring tool and needs to
> access
> > > /dev/ttySx. The nut driver is supposed to run
> under
> > > the nut user/group which is also part of the tty
> > > group. In other words, the application has
> correct
> > > access to the device. However, in my hardened
> box
> > > after emerging without errors and verifying that
> the
> > > nut user was added to the tty group, the nut app
> > > fails
> > > when trying to access /dev/ttyS0 and reports
> > > "permission denied".
> > >
> > > I'm sure all this is due to my lack of
> experience
> > > but
> > > could someone please give me the big picture.
> >
> > May I add:
> >
> > non-hardened # ls -la /dev/ttyS0
> > lrwxrwxrwx 1 root root 5 Apr 27 12:39 /dev/ttyS0
> ->
> > tts/0
> >
> > hardened # ls -la /dev/ttyS0
> > crw-rw---- 1 root uucp 4, 64 May  8 00:19
> /dev/ttyS0
> >
> > Do I just need to manually change permissions for
> this
> > device?
> >
> > > Thank you.
> > >
> > > Vieri



 
____________________________________________________________________________________
Now that's room service!  Choose from over 150,000 hotels
in 45,000 destinations on Yahoo! Travel to find your fit.
http://farechase.yahoo.com/promo-generic-14795097
-- 
gentoo-hardened@g.o mailing list