setuid 0 for extensions (e.g. fbterm.tcz)

[christophed]

To be really useful at the moment (shortcuts for multiple terminals etc...) fbterm in it's current iteration needs a setuid 0 bit (also see http://www.linuxcertif.com/man/1/fbterm/#SECURITY_NOTES_806h). Although in its own this has (possible) security implications there's no real better workaround on TinyCore Linux I found (if there is, I'd sure like to hear).

I originally thought I'd just alter the local .tcz archive in $TCE/optional/fbterm.tcz:

1. unsquashing
2. chmod 7455 on usr/local/bin/fbterm
3. squash it up again
3. reload (changed) fbterm.tcz

The approach above did not work unfortunately. It seems like squashfs discards or ignores setuid bits. Which means none of the tcz's can import these bits into the base filesystem (which, depending on the view, may be a very good thing).

So my workaround currently involves a small remastering of tinycore.gz (which is particulary easy and nicely documented in the wiki ;-)

Code: [Select]

# unpack current
mkdir current
cd current
zcat /mnt/hda1/boot/tinycore.gz | sudo cpio -i -H newc -d
cd ..

# and then while having fbterm.tcz mounted
cp /usr/local/bin/fbterm current/usr/local/bin/
chmod 7455 current/usr/local/bin/fbterm

# pack
cd current
sudo find | sudo cpio -o -H newc | gzip -2 > ../tinycore.gz
cd ..
advdef -z4 tinycore.gz

This was quite easy since fbterm.tcz only contains 1 file (/usr/local/bin/fbterm) so I did not have to put a lot of files into the base image. But it's hardly elegant.

The disadvantage is I need to tce-load all fbterm's dependencies (fontconfig, gpm, libxft, libx86) 'manually' before starting fbterm.

Can anyone think of a better way to solve this in TCL?

[maro]

Yep, when using the correct permission (i.e. '4755') for the 'chmod' command I managed to create an extension where '/usr/local/bin/fbterm' has setUID. You could try it yourself:

Code: [Select]

# download the required extensions
tce-load -w fbterm
tce-load -wi squashfs-tools-4.x
# extract the extension in question
mv $(cat /opt/.tce_dir)/optional/fbterm.tcz* .
sudo rm -rf squashfs-root
sudo unsquashfs fbterm.tcz
# apply the change
sudo chmod 4755 squashfs-root/usr/local/bin/fbterm
# re-package the extension
rm -f fbterm.tcz
mksquashfs squashfs-root fbterm.tcz
md5sum fbterm.tcz > fbterm.tcz.md5.txt
# install the newly updated extension
mv fbterm.tcz* $(cat /opt/.tce_dir)/optional
tce-load -i fbterm
# check that the result is as intended
ls -lL $(which fbterm)BTW, my result was:

Code: [Select]

-rwsr-xr-x    1 root     root         73308 Nov  6  2010 /usr/local/bin/fbterm

[curaga]

Yes, the Xorg server comes setuid, it wouldn't work otherwise. Perhaps you tried to load the new extension without removing the old file? Extensions do not overwrite existing files by default.

[christophed]

Thanks maro and curaga!

@curaga: you were right. I must have tried loading the extension without removing the old file (oops). Now it works perfectly this way.