[plug] ssh, su, screen. Conflict?

[James Devenish]

Hi,

In message <da8fea9e0412040655632e4283 at mail.gmail.com>
on Sat, Dec 04, 2004 at 02:55:52PM +0000, Lyndon Maydwell wrote:
>         su to user1
>         try to reatach screen // [screen -x | screen -r]
> This results in a message saying:
>         Cannot open your terminal "/dev/pts/4" - please check.

This, though obscure, is a consequence of UNIX permissions (i.e. it's
"security feature" that acts like a bug). My interpretation is this:

 - When you logged in as user2, the special device /dev/tty (acting as
   your terminal) was linked to /dev/pts/4, and the ownership of
   /dev/pts/4 was set to user2 with no permissions granted for any other
   users.
 - /dev/tty is a special descriptor (like 'standard input' and 'standard
   output') in that it is 'local' to each process: the kernel provides
   /dev/tty through magic and trickery and it seems to just work. Each
   process sees its own /dev/tty and cannot see or access /dev/tty for
   any other process.
 - When you su to user1, user1's shell succeeds because it is using
   /dev/tty. This is despite the fact that /dev/pts/4 is owned by user2:
   /dev/tty 'just works' for user1 because it is inherited by the child
   process using the aforementioned smoke-and-mirrors in the kernel.
 - Unfortunately, /dev/tty for a detached screen has no meaning (it *is*
   detached after all!).
 - When you try to reattach user1's screen, the detached session has
   to try to grab control of /dev/pts/4 directly. However, /dev/pts/4
   is owned by user2 and user1 has no permissions to use it!!
 - Hence, you get the error message.

As for solutions, I don't know. On a multi-user system, /dev/pts/4
should *not* be world-readable because that would allow other users
(including web scripts) to sniff your entire terminal session. You
could try using `chown` to change the ownership of /dev/pts4 to user1.
(User2's shell shouldn't have any trouble with this if it is using
/dev/tty.) Bizarre, but transparent solutions probably require OS-
specific hacks.