Red Hat Bugzilla – Bug 254961
SERVER INTERPRETED ACCESS TYPES - FUBAR
Last modified: 2009-07-14 12:48:42 EDT
Description of problem:
In an attempt to make this work:
# cat /etc/X0.hosts
as documented, I noticed that can NOT work because os/access.c is missing
call to strchr, so several strcmp calls end up comparing
"localgroup" to "localgroup:xuser" or whatever...
And as an extra bonus, if I do not specify -auth parameter to Xorg,
access from localhost is granted for everyone, totally ignoring
my ONLY line in /etc/X0.hosts.
I now run Xorg, started with command:
xinit /home/safari/.xinitrc -- -tst -novtswitch -nolisten tcp -audit 4
-logverbose 666 -verbose 666
Now lusers with group != xuser get denied:
AUDIT: Sun Aug 26 15:20:37 2007: 4617 X: client 26 rejected from local host (uid
527, gid 528)
AUDIT: Sun Aug 26 15:20:37 2007: 4617 X: client 26 disconnected
(I just have to do 'newgrp xuser' before starting X programs... no need for
pam_xauth.so, iptables rules for port 6000 accesss, xauth, ...)
Now I only have to find a way to disallow adding/removing hosts with xhost.
But that's next week's project.
I attached a patch which fixes the situation for me...
1) take care of ':'
2) bail out of EnableLocalHost if at least one FamilyServerInterpreted
-type host is specified. (called from auth.c:CheckAuthorization() )
real fix would be adding some saner parsing for ':' and maybe
command line flag for Xorg which disables call to EnableLocalHost
if no -auth was specified. or what??
Version-Release number of selected component (if applicable):
Steps to Reproduce:
1. echo "si:localgroup:xuser" > /etc/X0.hosts
2. xinit ~/.xinitrc
3. as user not having gid xuser, start some X program
X program can be started
not ignoring /etc/X0.hosts
Created attachment 172941 [details]
an evil hack to make si:localgroup/localuser work
Based on the date this bug was created, it appears to have been reported
during the development of Fedora 8. In order to refocus our efforts as
a project we are changing the version of this bug to '8'.
If this bug still exists in rawhide, please change the version back to
(If you're unable to change the bug's version, add a comment to the bug
and someone will change it for you.)
Thanks for your help and we apologize for the interruption.
The process we're following is outlined here:
We will be following the process here:
http://fedoraproject.org/wiki/BugZappers/HouseKeeping to ensure this
doesn't happen again.
Changing version to '9' as part of upcoming Fedora 9 GA.
More information and reason for this action is here:
This message is a reminder that Fedora 9 is nearing its end of life.
Approximately 30 (thirty) days from now Fedora will stop maintaining
and issuing updates for Fedora 9. It is Fedora's policy to close all
bug reports from releases that are no longer maintained. At that time
this bug will be closed as WONTFIX if it remains open with a Fedora
'version' of '9'.
Package Maintainer: If you wish for this bug to remain open because you
plan to fix it in a currently maintained version, simply change the 'version'
to a later Fedora version prior to Fedora 9's end of life.
Bug Reporter: Thank you for reporting this issue and we are sorry that
we may not be able to fix it before Fedora 9 is end of life. If you
would still like to see this bug fixed and are able to reproduce it
against a later version of Fedora please change the 'version' of this
bug to the applicable version. If you are unable to change the version,
please add a comment here and someone will do it for you.
Although we aim to fix as many bugs as possible during every release's
lifetime, sometimes those efforts are overtaken by events. Often a
more recent Fedora release includes newer upstream software that fixes
bugs or makes them obsolete.
The process we are following is described here:
Fedora 9 changed to end-of-life (EOL) status on 2009-07-10. Fedora 9 is
no longer maintained, which means that it will not receive any further
security or bug fix updates. As a result we are closing this bug.
If you can reproduce this bug against a currently maintained version of
Fedora please feel free to reopen this bug against that version.
Thank you for reporting this bug and we are sorry it could not be fixed.