🚀 go-pugleaf

I'm busy looking for potential security holes in a suid root program.

Currently, the program does the following:

	system("/bin/stty -echo ...");

Now, I realize that the "exec-ed" program also has to be "trusted",
or there is a security hole (i.e. If I can replace /bin/stty, all
bets are off).

Now suppose that I do "all the correct things" before issuing the
"system" call (set IFS, etc.) is this worse/same as the following:

	tcgetattr(fd, &t);
	t.c_lflag &= ~ECHO;
	tcsetattr(fd, TCSANOW, &t);

Any insight is greatly appreciated.
-- 
Stephen J. Roznowski	(sjr@afterlife.ncsc.mil)