Quote:
Originally Posted by veerain
Well TBone I said that sarcastically.
|
Right...which is against LQ Rules.
Quote:
Well If it's a one user system there is no security risk. If not it is. Well seeing other console is a big security hole.
What if a root or other user with access to /dev/fbx views the console of other user when he/she is viewing passwords for example from a password manager which displays password or viewing a text with sensitive info.
|
...which goes back to "you restrict access to the console to
START WITH, and that's not an issue, is it? Which was pointed out to start with. You DO NOT log in at the console for ANYTHING, except maintenance, and you restrict access to the computer room too. THAT is security layer one. Also, such things are GUI based...which a
virtual console is NOT.
Quote:
|
With fbgrab command you can even save the snapshot of framebuffer and store it in a image file. You don't have to be root. Just assigning the user to video group which has access to /dev/fbx is a security risk. I think in TBone machine he sets /dev/vcs* and friends group to be accessed by multiple users by giving them video group perms.
|
What I do is have secure systems. This 'hole' is meaningless, and remains so. Again,
NO ONE does serious sensitive work from the system console. If they do, you have MANY more security issues than the video group.
Quote:
|
If you can think then you know it's security risk. And I am issuing the security vulnerability report. You can find out in web search what's security issue if someone can view what you are viewing.
|
I can think very well, thanks...you appear to not be following what anyone else is saying, or the points they're making. And again, you mentioned SPECIFIC kernels...why don't
YOU do the web search and provide the proof of this 'horror'??? You've been asked several times now, and still haven't. You say that *I* can "find out in web search", but I'm not the one trying to make this point...YOU ARE. Provide some proof, please.
