Re: [PATCH] Secure login and sulogin on S390x

[Chris Hofstaedtler <zeha@debian.org>]

* Werner Fink <werner@suse.de> [260429 11:30]:
>Some remarks: on S390x architecture of modern zSeries the hypervisor
>does log the console I/O.  For both the 3215 half duplex line mode as
>well as the 3270 full-screen/block mode console type the I/O is logged
>on the hypervisor's side.  To control this there are command send via
>/dev/vmcp to tell the  z/VM control program of the hypervisor not to
>log during entering the password.  For the 3215 console also automatic
>scroll is enabled which avoid to press CLEAR to get the password prompt
>if on the next block.

[..]
> 9 files changed, 436 insertions(+), 12 deletions(-)

This seems to add a lot of code to util-linux. I was wondering if 
sulogin is the only place that needs this log filtering. What 
about su, sudo, doas and so on? Note that there are different su 
(and probably doas) versions in use across distributions.

Wouldn't it be better if the hypervisor would not log input if the 
terminal output was disabled? That seems like behaviour commonly 
found in other virtual terminal emulators.

Best,
Chris