Attempting to use write(1) in recent versions of bsdextrautils
invariably (unless run by root) results in:

  write: effective gid does not match group of /dev/pts/NN

Of course, now that the pre-1995 behaviour was restored and the tty
group isn't used, a malicious actor no longer has to jump through
the hoops of finding mistakes in any sgid programs and can just
directly cat arbitrary escape sequences to the terminal of a user
who has mesg y set.
But when you want to actually pass a message to another user rather
than mess with their terminal or exfiltrate their passwords, the
write command used to be more convenient than cat, as it could find
the right terminal to use itself and added a nice greeting header
with the caller's name and terminal.

The problem is also present in stable. To be honest, I'm a bit
surprised that such change was pushed to stable together with a
bugfix without even mentioning it in NEWS or something. Whatever
the reason, the write command is completely unusable in that
configuration.

* mwgamera@gmail.com <mwgamera@gmail.com> [241022 22:42]:
[..]

https://lists.debian.org/debian-security-announce/2024/msg00058.html
is the context for the change.

It still works as root, and this restriction will remain
indefinitely.

Chris

* mwgamera <mwgamera@gmail.com> [241023 01:32]:

The "fix" was incomplete and IIRC later confirmed to be impossible
to ever be correct for 100% of cases.

This part is not new.

True, the egid check is useless and probably wrong now.

So yeah. When people have 'mesg y', they accept that their terminal
can be broken/run arbitrary commands. For 'mesg n' (default), it is
now reasonably secure.
root can continue running write/wall to pass messages to 'mesg n'
users, and everything else is effectively deprecated.

Chris

Hi,

sorry for the late reply.

As you've probably already seen, in unstable mesg and write are
already gone. wall still works, provided the caller is either root
or wants to write to its own terminals.

For bookworm, a stable update is in the works that undoes the mesg
change. write(1) stays non-setgid, and sysadmins can make it setgid
tty again, if they so desire. However, security bugs resulting from
such a configuration will probably not see a lot of attention.

Thanks for bringing this to my attention!

Chris