Synopsis: dump exposes 'tty' group
NetBSD versions: 1.5, 1.5.1
Thanks to: John Hawkinson
Reported in NetBSD Security Advisory: NetBSD-SA2001-014

Index: main.c
===================================================================
RCS file: /cvsroot/basesrc/sbin/dump/main.c,v
retrieving revision 1.25.6.3
retrieving revision 1.25.6.4
diff -c -p -r1.25.6.3 -r1.25.6.4
*** main.c      2001/05/15 21:55:58     1.25.6.3
--- main.c      2001/08/08 18:13:22     1.25.6.4
*************** __RCSID("$NetBSD: main.c,v 1.25.6.3 2001
*** 80,85 ****
--- 80,86 ----
 #include "dump.h"
 #include "pathnames.h"

+ gid_t egid;                   /* Retain tty privs for notification */
 int   notify = 0;             /* notify operator flag */
 int   blockswritten = 0;      /* number of blocks written on current tape */
 int   tapeno = 0;             /* current tape number */
*************** main(argc, argv)
*** 118,123 ****
--- 119,128 ----

       spcl.c_date = 0;
       (void)time((time_t *)&spcl.c_date);
+
+       /* Save setgid bit for use later */
+       egid = getegid();
+       setegid(getgid());

       tsize = 0;      /* Default later, based on 'c' option for cart tapes */
       if ((tape = getenv("TAPE")) == NULL)
Index: optr.c
===================================================================
RCS file: /cvsroot/basesrc/sbin/dump/optr.c,v
retrieving revision 1.13.10.1
retrieving revision 1.13.10.2
diff -c -p -r1.13.10.1 -r1.13.10.2
*** optr.c      2000/10/18 00:39:44     1.13.10.1
--- optr.c      2001/08/08 18:13:18     1.13.10.2
*************** void    alarmcatch __P((int));
*** 73,78 ****
--- 73,79 ----
 struct fstab *allocfsent __P((struct fstab *fs));
 int   datesort __P((const void *, const void *));
 static        void sendmes __P((char *, char *));
+ extern  gid_t egid;

 /*
  *    Query the operator; This previously-fascist piece of code
*************** broadcast(message)
*** 225,236 ****
--- 226,241 ----
       if (!notify || gp == NULL)
               return;

+       /* Restore 'tty' privs for the child's use only. */
+       setegid(egid);
       switch (pid = fork()) {
       case -1:
+               setegid(getgid());
               return;
       case 0:
               break;
       default:
+               setegid(getgid());
               while (wait(&s) != pid)
                       continue;
               return;