Subject: Re: Xserver SUID root? or restrict /dev/kbd?
To: None <port-sun3@NetBSD.ORG>
From: Ty Sarna <tsarna@endicor.com>
List: port-sun3
Date: 08/10/1995 19:50:49
In article <9508101601.AA26558@bach>, Gordon W. Ross <gwr@mc.com> wrote:
> > something like the SunOS 'fbtab' functionality (though a bit more
> > general) would probably be a useful thing, for NetBSD in general...
> 
> What do you think of the idea of making /dev/kbd and /dev/mouse
> require the same session as /dev/kb (console keyboard/display)?
> I tried out changes to do that and it's pretty easy.
> (change posted in a previous message)

> (2) make getty fix up related devices based on /dev/fbtab

Login is the main program needing mods.  I'm less sure what getty needs
to do (just change things back afterwards, I think)

> Would anyone like to offer arguments for any particular way?

fbtab is the more flexible approach, since it allows arbitrary
files/devices to have their ownership changed.  For example, permission
on the audio device would normally want to go with the console ownership
as well.  OTOH, maybe some audio devices or framebuffers are
fixed-function in some applications and this is undesirable. Having
to hack the kernel to make it do the right thing is bad.  fbtab allows
this to be configured either way, without touching the kernel.  It also
allows for future devices (holographic projectors, /dev/smell, etc...
:->) to be added easily without continually adding more permissions
kludges.

Work in this area is at the top of my list of things to do when I get a
new NetBSD machine (waiting for $$), as part of a rework of the S/Key
support.  I'd like to make it more flexible that the way I did it
before. 

But, if anyone doesn't want to wait, go ahead. fbtab is independant of
the S/Key stuff anyway, and won't interfere with it. FreeBSD does have
some fbtab support.