Rolf Leggewie schrieb: > thank you for reporting this ticket. I fail to see the issue. If any > kind of dialer needed to replace /usr/sbin/isdnctrl that would require > full admin priviledges. Where is the problem?
Hi Rolf, good to know that debian hunts bugs even if they are 7 years old ;) IIRC the problem is that the ISDN dialout/numbers are controlled via /dev/isdnctrl0 kernel device. /usr/sbin/isdnctrl is just a tool to write control data to this kernel device. If a user belongs to group "dialout" he/she will be allowed to write to the device /dev/isdnctrl0 which has the permissions/owner/group crw-rw---- root:dialout So any member of group "dialout" will be able to dial any phone number he/she wants. If the user has a tool which writes the necessary data to /dev/isdnctrl0. /usr/sbin/isdnctrl tries to prevent this, but itself provides such a "tool" when you just remove one "if" statement, recompile it in your home directory and execute the resulting binary. IMHO the "if" statement is just "security by obscurity". In fact the user is member of group "dialout" and is allowed to do anything with the device /dev/isdnctrl0. In contrary, without being member of group dialout, a non-privileged user will not be able to do anything with isdnctrl. So the tool "isdnctrl" would be rendered unusable for normal users by removing group write permission from /dev/isdnctrl0: crw------- root:dialout Unfortunately I do not have any ISDN host for testing purposes any more. Regards, Daniel -- To UNSUBSCRIBE, email to debian-bugs-dist-requ...@lists.debian.org with a subject of "unsubscribe". Trouble? Contact listmas...@lists.debian.org
