August 2003 - Grx

Online Demo against Software Patents
by Eike Lange 26 Aug '03

26 Aug '03

Hi Folks! I'd like to replace the index page of GRX and GPC with a small notice about the online demo. Please see http://www.ffii.org for an example. This page should last until thursday or friday of this week. Please feel free to contribute to this demo with your own websites. Are there any objections? Eike -- "Freie Software braucht Freie Dokumentation." Das GNU-Pascal Buch! http://www.gnu-pascal.de/~eike/

1 0

Re: demogrx security issue
by Mariano Alvarez Fernandez 19 Aug '03

19 Aug '03

Thanks for the info. Anyway I think demogrx is only a demo, but is good to know about this problem. Thanks again, and feel free to post about your project to the grx mailing list. M.Alvarez fabio wrote: > Hi, i've been interested in using grx libraries to make a media station > (something like the FreeVo Project, http://freevo.sourceforge.net/) I've > find a security issue in the demogrx test binary. If i want to use the svga > driver, the readme say that i must setuid the test programs to make them > work. In demogrx.c there is an invocation of system(): > > (line 402): > for (i = 0; i < NDEMOS; i++) { > if (ev->p1 == ptable[i].cid) { > gfaz_fin(); > #if defined(__MSDOS__) || defined(__WIN32__) > if (ev->p1 == ID_MODETEST) > strcpy(nprog, "..\\bin\\"); > else > strcpy(nprog, ".\\"); > #else > if (ev->p1 == ID_MODETEST) > strcpy(nprog, "../bin/"); > else > strcpy(nprog, "./"); > #endif > #if defined(__XWIN__) > strcat(nprog, "x"); > #endif > strcat(nprog, ptable[i].prog); > system(nprog); > :(line 420) > > This is extracted from the system(3) man page: > > Do not use system() from a program with suid or sgid privileges, > because strange values for some environment variables might be used to > subvert system integrity. Use the exec(3) family of functions instead, > but not execlp(3) or execvp(3). system() will not, in fact, work prop- > erly from programs with suid or sgid privileges on systems on which > /bin/sh is bash version 2, since bash 2 drops privileges on startup. > (Debian uses a modified bash which does not do this when invoked as > sh.) > > In poor words, a user can (for example) make a > ln -s /bin/sh rgbtest , > then execute the demogrx program, click on "Rgbtest" and he will gain a root > shell. I've tried it on Knoppix 3.1, Slackware 9.0, and it works. > The solution is to use the exec(3) family of functions. > > Good work for the library, i've find it very useful to write quickly graphical > applications. I will notice you when my media station will be ready, if you > like :-) > > Fabio Bas >

2 1

xfdga small changes
by Dimitar Zhekov 11 Aug '03

11 Aug '03

I understimated XFree86/DGA, it can now work with LOTS of modes. Mariano, please state that the DGA2 driver is not experimental any more. Now that DGA/DGA2 is stable, I fully tested it and found no errors. It would be nice to have a non-root mode of the driver/grx, using DGA2 to set modes and XLib (i.e. fd_xwin.c) doing all drawing. I'll try to write it. -- E-gards: Jimmy

1 0

speedtst batch mode
by Dimitar Zhekov 11 Aug '03

11 Aug '03

Hi. A batch mode for speedtst. Usage: run speedtst to see the mode numbers, then "time speedtst MODE" or [4dos] "timer ^ speedtst ^ timer". Maybe "first" should be named "prompt". -- E-gards: Jimmy

1 0