Re: gtk+-1.2.10

["J. Ali Harlow" <gtk-list avrc city ac uk>]

On Wed, 14 Mar 2001, strout etcsupport com wrote:
> As mentioned in the message, the game itself is owned by games (the
> user) and bin (the group).  The permissions on the executable are :
> rwxr-xr-x.  (BTW - this is the QT-hack variant)
> 
> I won't pretend to know what's going on inside, but I know that the
> saved files are owned games:user (user being the primary group of the
> user)
> 
> Unix NetHack Version 3.3.1 compiled with QT support.
> 
> After pulling open the source code and taking a look, nethack does
> actually setgid/setuid on a file save:
> 
> nethack-3.3.1/src/files.c: line 758-759
>         (void) setgid(getgid());
>         (void) setuid(getuid());

These two lines drop privileges before running gzip (or whatever), as explained
on lines 742-744 of that same file.

> The game itself doesn't run setuid/setgid so I think this would work
> under GTK since GTKs issue is only with having the permissions
> setuid/setgid.

I'd guess you are getting confused with the shell script which launches
NetHack. If you are running a "standard" NetHack configuration (ie., not Debian,
and others that conform to FHS instead), /usr/games/nethack is the shell script
(about 1Kb), the executable is in /usr/games/lib/nethackdir/nethack and will be
a lot bigger. In it's FHS2.0 configuration, Slash'EM puts the executable in
/usr/lib/games/slashem/slashem, I imagine Debian NetHack will do something
similar. Ben will no doubt tell me if I've guessed wrong. You can look inside
the shell script (see what HACKDIR is set to) to check.

I think you'll find that if you look a little more closely, that you've got
NetHack running setuid games. If I'm right, and you install version 1.2.9 of
GTK+ then attempting to use Gnome interface will cause GTK+ to abort the game
for you. Of course, if you're using the Qt interface, then you will have no
such worries.

-- 
Ali Harlow                              Email: ali avrc city ac uk
Research programmer                     Tel:   (020) 7477 8000 X 4348
Applied Vision Research Centre          Intl: +44 20 7477 8000 X 4348
City University                         Fax:   (020) 7505 5515
London                                  Intl: +44 20 7505 5515