Subject: Re: kde2 adds a *lot* of setuid-root programs!!!!
To: NetBSD Security Technical Discussion List <tech-security@NetBSD.ORG>
From: Greg A. Woods <woods@weird.com>
List: tech-security
Date: 05/24/2001 17:40:53
[ On Thursday, May 24, 2001 at 19:46:03 (+0100), Jasper Wallace wrote: ]
> Subject: Re: kde2 adds a *lot* of setuid-root programs!!!!
>
> > what the heck is a .kss anyway?
> 
> screensaver.
> 
> I guess they need to be setuid root to check the users password for when
> they lock the screen.

Oh, my.  That's extremely scary!  I guess I'll fix that right
now.... (not all my users can be trusted not to play!  ;-)

At the worst you'd think they could invoke a setuid helper/wrapper to do
the check for them (there seems to be at least one or two of these
already there as part of KDE).

-- 
							Greg A. Woods

+1 416 218-0098      VE3TCP      <gwoods@acm.org>     <woods@robohack.ca>
Planix, Inc. <woods@planix.com>;   Secrets of the Weird <woods@weird.com>