Re: CVS commit: src/usr.bin/rsh

[David Holland <dholland-sourcechanges%netbsd.org@localhost>]

On Thu, Oct 30, 2014 at 04:40:57PM +0000, David Holland wrote:
 >  > } 
 >  > } Module Name:	src
 >  > } Committed By:	dholland
 >  > } Date:		Thu Oct 30 06:13:50 UTC 2014
 >  > } 
 >  > } Modified Files:
 >  > } 	src/usr.bin/rsh: rsh.c
 >  > } 
 >  > } Log Message:
 >  > } Drop setuid before execing rlogin. Failure to do so should be
 >  > } harmless, but is sloppy.
 >  > 
 >  >      Uh...
 >  > 
 >  > -r-xr-xr-x  1 root  wheel  16303 Sep 18 17:35 /usr/bin/rsh*
 > 
 > -r-sr-xr-x  1 root  wheel  16169 Sep 11 04:45 /bin/rcmd
 > 
 > It doesn't *work* if not setuid.

Although I suppose that code is outside IN_RCMD. So maybe it's
useless; but on the other hand, what are the odds of someone taking
the code and installing it the traditional way? Plus I'm sure the
Coverity report that triggered this discussion in the first place
thought the code was running setuid.

-- 
David A. Holland
dholland%netbsd.org@localhost