Subject: Re: Fix for PR security/8069: man(1) vulnerability
To: None <tech-security@netbsd.org>
From: Matthias Buelow <mkb@altair.mayn.de>
List: tech-security
Date: 07/26/1999 02:15:03
tron@zhadum.de (Matthias Scheler) wrote:

>Opinions?

As first aid, I'd do vi /etc/man.conf and :%s/nroff/groff -Tascii -S/.

For a cleaner modification, I'd introduce a user man,
chown -R man /usr/share/man and make man(1) setuid man.
I dunno, but I have seen man(1) write formatted catfiles to /usr/share/cat*,
am I mistaken that it doesn't do this on NetBSD and hence doesn't need
to have write access there?  Anyways, it's a good idea nevertheless to
give a subsystem like man its own user, imho.
What I miss is nroff -S.  nroff is just a script so that can easily
be added.

I'd much prefer if groff kept those problematic operations disabled
by default (especially when they're not in troff) but well.

mkb