From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1947388AbdDYN5C (ORCPT ); Tue, 25 Apr 2017 09:57:02 -0400 Received: from mail-io0-f171.google.com ([209.85.223.171]:33671 "EHLO mail-io0-f171.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1947159AbdDYN4y (ORCPT ); Tue, 25 Apr 2017 09:56:54 -0400 MIME-Version: 1.0 In-Reply-To: <20170425144746.0d8721a3@lxorguk.ukuu.org.uk> References: <20170425041512.13189-1-matt@nmatt.com> <20170425144746.0d8721a3@lxorguk.ukuu.org.uk> From: Jann Horn Date: Tue, 25 Apr 2017 15:56:32 +0200 Message-ID: Subject: Re: [PATCH v5 0/2] security: tty: make TIOCSTI ioctl require CAP_SYS_ADMIN To: Alan Cox Cc: Matt Brown , serge@hallyn.com, jmorris@namei.org, Greg Kroah-Hartman , jslaby@suse.com, Jonathan Corbet , Kees Cook , Andrew Morton , kernel-hardening@lists.openwall.com, linux-security-module@vger.kernel.org, linux-kernel@vger.kernel.org, linux-doc@vger.kernel.org Content-Type: text/plain; charset=UTF-8 Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On Tue, Apr 25, 2017 at 3:47 PM, Alan Cox wrote: >> There could be a few user programs that would be effected by this >> change. >> See: >> notable programs are: agetty, csh, xemacs and tcsh >> >> However, I still believe that this change is worth it given that the >> Kconfig defaults to n. This will be a feature that is turned on for the >> same reason that people activate it when using grsecurity. Users of this >> opt-in feature will realize that they are choosing security over some OS >> features > > Only in this case they are not. > > If I am at the point I have the ability to send you TIOCSTI you already > lost because I can just open /dev/tty to get access to my controlling tty > and use write(). In terms of PTYs, this patch does not try to prevent writes to a slave device (which afaik is what /dev/tty will give you). It tries to prevent the equivalent of writes to the master device. As far as I know, there is no way to go from a slave to the corresponding master without having access to the master in some other way already. From mboxrd@z Thu Jan 1 00:00:00 1970 From: jannh@google.com (Jann Horn) Date: Tue, 25 Apr 2017 15:56:32 +0200 Subject: [PATCH v5 0/2] security: tty: make TIOCSTI ioctl require CAP_SYS_ADMIN In-Reply-To: <20170425144746.0d8721a3@lxorguk.ukuu.org.uk> References: <20170425041512.13189-1-matt@nmatt.com> <20170425144746.0d8721a3@lxorguk.ukuu.org.uk> Message-ID: To: linux-security-module@vger.kernel.org List-Id: linux-security-module.vger.kernel.org On Tue, Apr 25, 2017 at 3:47 PM, Alan Cox wrote: >> There could be a few user programs that would be effected by this >> change. >> See: >> notable programs are: agetty, csh, xemacs and tcsh >> >> However, I still believe that this change is worth it given that the >> Kconfig defaults to n. This will be a feature that is turned on for the >> same reason that people activate it when using grsecurity. Users of this >> opt-in feature will realize that they are choosing security over some OS >> features > > Only in this case they are not. > > If I am at the point I have the ability to send you TIOCSTI you already > lost because I can just open /dev/tty to get access to my controlling tty > and use write(). In terms of PTYs, this patch does not try to prevent writes to a slave device (which afaik is what /dev/tty will give you). It tries to prevent the equivalent of writes to the master device. As far as I know, there is no way to go from a slave to the corresponding master without having access to the master in some other way already. -- To unsubscribe from this list: send the line "unsubscribe linux-security-module" in the body of a message to majordomo at vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html From mboxrd@z Thu Jan 1 00:00:00 1970 MIME-Version: 1.0 In-Reply-To: <20170425144746.0d8721a3@lxorguk.ukuu.org.uk> References: <20170425041512.13189-1-matt@nmatt.com> <20170425144746.0d8721a3@lxorguk.ukuu.org.uk> From: Jann Horn Date: Tue, 25 Apr 2017 15:56:32 +0200 Message-ID: Content-Type: text/plain; charset=UTF-8 Subject: [kernel-hardening] Re: [PATCH v5 0/2] security: tty: make TIOCSTI ioctl require CAP_SYS_ADMIN To: Alan Cox Cc: Matt Brown , serge@hallyn.com, jmorris@namei.org, Greg Kroah-Hartman , jslaby@suse.com, Jonathan Corbet , Kees Cook , Andrew Morton , kernel-hardening@lists.openwall.com, linux-security-module@vger.kernel.org, linux-kernel@vger.kernel.org, linux-doc@vger.kernel.org List-ID: On Tue, Apr 25, 2017 at 3:47 PM, Alan Cox wrote: >> There could be a few user programs that would be effected by this >> change. >> See: >> notable programs are: agetty, csh, xemacs and tcsh >> >> However, I still believe that this change is worth it given that the >> Kconfig defaults to n. This will be a feature that is turned on for the >> same reason that people activate it when using grsecurity. Users of this >> opt-in feature will realize that they are choosing security over some OS >> features > > Only in this case they are not. > > If I am at the point I have the ability to send you TIOCSTI you already > lost because I can just open /dev/tty to get access to my controlling tty > and use write(). In terms of PTYs, this patch does not try to prevent writes to a slave device (which afaik is what /dev/tty will give you). It tries to prevent the equivalent of writes to the master device. As far as I know, there is no way to go from a slave to the corresponding master without having access to the master in some other way already.