stty: no verification that tcsetattr applied all settings

[sylvestre]

Component

stty

Description

POSIX allows tcsetattr to return success while only partially applying requested changes. GNU stty re-reads terminal settings after tcsetattr and compares them to the requested configuration, exiting with an error if they differ. uutils calls tcsetattr and returns success without verification.

The tcsetattr() function shall return successfully if it was able to perform any of the requested actions, even if some of the requested actions could not be performed.

// src/uu/stty/src/stty.rs:425-431
for arg in &valid_args {
    match arg {
        ArgOptions::Mapping(mapping) => apply_char_mapping(&mut termios, mapping),
        ArgOptions::Flags(flag) => apply_setting(&mut termios, flag),
        // ...
    }
}
tcsetattr(opts.file.as_fd(), set_arg, &termios)?;
// No readback or comparison follows

GNU performs tcgetattr after setting, compares with eq_mode(), and calls error(EXIT_FAILURE, ...) if settings don't match.

Impact

On platforms where tcsetattr applies only a subset of changes, uutils exits successfully while the terminal remains misconfigured. Scripts disabling echo for password input may silently fail, exposing sensitive data.