Re: xterm -C and TIOCCONS vs. PRIV_TTY_CONSOLE

On 01/07/2011 06:09, Garrett Cooper wrote:
> On Thu, Jan 6, 2011 at 8:49 PM, Craig Leres<leres_at_ee.lbl.gov>  wrote:
>> On 01/06/11 20:05, Garrett Cooper wrote:
>>> Just to make sure we're both on the same page:
>>>
>>> $ grep xterm /etc/ttys
>>> ttyv0 "/usr/libexec/getty Pc"         xterm   on  secure
>>> ttyv1 "/usr/libexec/getty Pc"         xterm   on  secure
>>> ttyv2 "/usr/libexec/getty Pc"         xterm   on  secure
>>> ttyv3 "/usr/libexec/getty Pc"         xterm   on  secure
>>> ttyv4 "/usr/libexec/getty Pc"         xterm   on  secure
>>> ttyv5 "/usr/libexec/getty Pc"         xterm   on  secure
>>> ttyv6 "/usr/libexec/getty Pc"         xterm   on  secure
>>> ttyv7 "/usr/libexec/getty Pc"         xterm   on  secure
>>> ttyv8 "/usr/local/bin/xdm -nodaemon"  xterm   off secure
>>
>> No, that's not what mine looks like. I changed it to match and rebooted
>> but it doesn't help with the TIOCCONS issue.
>>
>> When I run xinit, it starts up the xterm -C which does a TIOCCONS. The
>> 8.1 kernel checks for PRIV_TTY_CONSOLE which isn't set and denies the
>> request:
>>
>>         case TIOCCONS:
>>                 /* Set terminal as console TTY. */
>>                 if (*(int *)data) {
>>                         error = priv_check(td, PRIV_TTY_CONSOLE);
>>                         if (error)
>>                                 return (error);
>>
>>                         /*
>>                          * XXX: constty should really need to be locked!
>>                          * XXX: allow disconnected constty's to be stolen!
>>                          */
>>
>>                         if (constty == tp)
>>                                 return (0);
>>                         if (constty != NULL)
>>                                 return (EBUSY);
>>
>>                         tty_unlock(tp);
>>                         constty_set(tp);
>>                         tty_lock(tp);
>>                 } else if (constty == tp) {
>>                         constty_clear();
>>                 }
>>                 return (0);
>>
>>
>> There's nothing I see in all of /usr/src that turns on PRIV_TTY_CONSOLE
>> in any case. You could rewrite the above like this:
>>
>>         case TIOCCONS:
>>                 /* Set terminal as console TTY. */
>>                 if (*(int *)data) {
>>                         return (EPERM)
>>                 } else if (constty == tp) {
>>                         constty_clear();
>>                 }
>>                 return (0);
>>
>> and it won't change any behavior.
>
>      Ok -- figured I would ask about the obvious. I wish I could help
> you further right now, but unfortunately I have a lot on my plate.
> I've CCed ed_at_ and the list again so that someone else might be able to
> chime in and help you further.
> Cheers, a
> -Garrett
> _______________________________________________
> freebsd-current_at_freebsd.org mailing list
> http://lists.freebsd.org/mailman/listinfo/freebsd-current
> To unsubscribe, send any mail to "freebsd-current-unsubscribe_at_freebsd.org"
>

This is not a new problem, as it lead to a thread on hackers_at_ in November 2008
(search for "[Testers wanted] /dev/console cleanups" and "xconsole").

I tried a "proof of concept" by building a kernel with options MAC, and patching
mac_stub.c to have stub_priv_grant() return 0 in stade of EPERM for
PRIV_TTY_CONSOLE.

With this, the kernel messages are displayed in xconsole, but not the others
messages sent with syslog.

Of course, this hack is not to be used on a production system.

I hope that a true solution will be found one day or another.

Claude Buisson.