Re: [PLUG] the most serious vuln (today)

[Rich Freeman <r-plug@thefreemanclan.net>]

On Wed, Apr 11, 2018 at 11:03 AM, Fred Stluka <fred@bristle.com> wrote:
> On 4/9/18 1:24 PM, Rich Freeman wrote:
>>
>> On Mon, Apr 9, 2018 at 12:25 PM, jeff<jeffv@op.net>  wrote:
>>>
>>> https://www.securityweek.com/vulnerabilities-found-linux-beep-tool
>>
>> Hmm, Gentoo does not install beep by default, and when it is installed
>> it does not set the suid bit by default.  It has also been fixed on
>> Gentoo anyway.  I have to imagine most distros will be patching this.
>>
> Interesting...  I never knew there was an official beep command.
> I wrote one myself 30 years ago.  It's a shell script that simply echoes
> a Ctrl-G character.  I later added a feature to echo a text string as well
> as beeping.
>

I think the intent of the beep program (especially if installed suid)
is for programs to be able to beep the speaker WITHOUT having write
access to the system console or audio devices (such as for a daemon).

Echoing Ctrl-G is a superior solution for console-oriented software,
because for remote connections it will beep the user's terminal, and
not the system console (which could be on the other side of the planet
in a datacenter).

I believe the intent of the beep command is to only beep the system
speaker itself.  Perhaps it might be used by some kind of daemon to
get an operator's attention/etc.  Really though I don't see the point
as it tends to conflate the more desktop-oriented experience (where
the user should have write access to console/audio/etc) and the more
server-oriented experience (where there are certainly better ways to
do monitoring, especially since that little PC speaker doesn't scale
well when you have racks of servers in a noisy room, possibly remotely
administered).

-- 
Rich
___________________________________________________________________________
Philadelphia Linux Users Group         --        http://www.phillylinux.org
Announcements - http://lists.phillylinux.org/mailman/listinfo/plug-announce
General Discussion  --   http://lists.phillylinux.org/mailman/listinfo/plug