Public SourceMage Discussion List

[Javier Vasquez <j.e.vasquez.v AT gmail.com>]

On Sat, Aug 9, 2014 at 10:58 AM, Thomas Orgis <thomas-forum AT orgis.org> wrote:

...

I upgraded an SMGL box with devel-xorg grimoire and was hit by urxvt
not being able to open pseudo-ttys anymore. Then I stumbled over this:

http://lists.schmorp.de/pipermail/rxvt-unicode/2013q3/001840.html

Javier, would you like to elaborate? It seems like putting users in tty
group or setting urxvt setgid tty works ... but why is that suddenly
necessary? And why does xterm not need that (it has setgid utmp ... an
different matter)?

It all comes form a glibc change:

https://mailman.archlinux.org/pipermail/arch-dev-public/2013-August/025332.html
https://bugs.archlinux.org/task/36548

The following is mentioned as an alternative:

https://wiki.archlinux.org/index.php/rxvt-unicode#Pseudo-tty

However, such alternative didn't make sense to me, given rxvt-unicode was still authenticating with the user groups, and if the user wasn't included in tty, then I thought there was no way that was going to work.

xterm worked OK at that time, because it was/is setting setgid to utmp, look at the spell at test grimoire.  BUILD includes:

OPTS="$OPTS --with-utmp-setgid=utmp"

And INSTALL includes:

create_group utmp &&

Therefore, if the user was not part of tty, then xterm would authenticate it as utmp automatically, and as xterm was setgid to utmp, there was NO problem.

Such approach is now a days not used on other distros like Arch.  See:

https://projects.archlinux.org/svntogit/packages.git/plain/trunk/PKGBUILD?h=packages/xterm

You'll find instead they're using plain:

--with-tty-group=tty

They're no longer using utmp, neither setgid, I believe given some security concerns...

rxvt-unicode didn't, and still doesn't have this feature.  They just authenticate with the user and the groups it belongs to.

So the only real solutions I found, were to add the user to the tty group, or to setgid urxvt.  I didn't like the setgid approach, since for some reason sounded riskier (I might have been wrong).  Here some additional thoughts I found at the time:

http://www.pc-freak.net/blog/how-to-work-around-screen-cannot-open-your-terminal-devpts1-please-check

Distros using systemd like Arch, for some reason have their problems solved.  For them, /dev/pts still has just root accesses:

% ls -ld /dev/pts
drwxr-xr-x 2 root root 0 Aug  9 11:28 /dev/pts

% ls -l /dev/pts
total 0
crw--w---- 1 <username> tty  136, 0 Aug  9 14:00 0
crw--w---- 1 <username> tty  136, 1 Aug  9 14:14 1
crw--w---- 1 <username> tty  136, 2 Aug  9 13:58 2
c--------- 1 root     root   5, 2 Aug  9 11:28 ptmx

And <username> doesn't belong to group tty, and there's no setgid applied to xterm neither urxvt:

% ls -l /usr/bin/urxvt
-rwxr-xr-x 1 root root 1.3M May 31 22:41 /usr/bin/urxvt

% ls -l /usr/bin/xterm
-rwxr-xr-x 1 root root 508K Jul 17 07:50 /usr/bin/xterm

And still both xterm and urxvt work out of the box without adding <username> to tty.  Which I really don't know how that works.  Systemd has absorved so many things, including authentication, that now a days is hard to say what's going underneath.  That's one of the reason I really dislike systemd, but that's a different topic.

If you're not using systemd, I really see no way you get this working without setting gid and/or adding the user to tty group.  Also I can't see how just changing the group (gid) to tty on /dev/pts would solve the problem, if the user any ways don't belong to that group...

Again, the easiest, and thought to be less risky to me, was just to add the user to the tty group.

I hope this clarifies at least my findings, and why xterm and rxvt-unicode behave differently.

Thanks,

--
Javier.