Re: [kernel-hardening] Re: [PATCH v6 0/2] security: tty: make TIOCSTI ioctl require CAP_SYS_ADMIN

[Boris Lukashev <blukashev@sempervictus.com>]

[-- Attachment #1: Type: text/plain, Size: 3752 bytes --]

To put a bit of a red team spin on this: if its not fixed in the kernel,
binaries/shellcode specifically written to abuse the functionality will be
introduced by the attacker to take advantage of the hole. Defense in depth
means mitigating each tier of the attacker's progression, not simply
blocking initial ingress/execution.
SELinux is not omnipresent, almost never properly configured, and from the
point of view of practical security in the critical infrastructures using
Linux, not an appropriate response when relating to kernel functionality -
"WONTFIX beacuause NOTMYPROBLEM" is what got us all here in the first
place.
Finally, far as compatibility goes, disabling the protective measure for
the small segment of valid violators of proper use semantics handles the
concern - either system-wide as a sysctl, or via the TPE implementation
itself.

Can we all agree that the primary purpose of this effort is to harden the
system, with cowtowing to "improperly implemented consumers" reduced to
only the most common cases which would actually impede users?
If we dont, it wont be long till elephant tears about Wine and VirtualBox
flood these discussions.

On Wed, May 17, 2017 at 2:25 PM, Daniel Micay <danielmicay@gmail.com> wrote:

> On Wed, 2017-05-17 at 17:41 +0100, Alan Cox wrote:
> > > If we're adjusting applications, they should be made to avoid
> > > TIOSCTI
> > > completely. This looks to me a lot like the symlink restrictions:
> > > yes,
> > > userspace should be fixed to the do the right thing, but why not
> > > provide support to userspace to avoid the problem entirely?
> >
> > We do it's called pty/tty. There isn't any other way to do this
> > correctly
> > because TIOCSTI is just one hundreds of things the attacker can do to
> > make your life miserable in the case you create a child process of
> > lower
> > security privilege and give it your tty file handle or worse (like
> > some
> > container crapware) your X11 socket fd.
> >
> > Does it really matter any more or less if I reprogram your enter key,
> > use
> > TIOCSTI, set the baud rate, change all your fonts ?
> >
> > The mainstream tools like sudo get this right (*). Blocking TIOCSTI
> > fixes
> > nothing and breaks apps. If it magically fixed the problem it might
> > make
> > sense but it doesn't. You actually have to get an adult to write the
> > relevant code.
>
> It gets it right because it was reported as a vulnerability and fixed,
> which is the cycle many of these tools have gone through. It looks like
> sudo and coreutils / shadow su were fixed in 2005, but there are more of
> these tools.
>
> CVE-2005-4890 (coreutils su, shadow su, sudo), CVE-2016-7545 (SELinux
> sandbox utility), CVE-2016-2781 (chroot --userspec), CVE-2016-2779
> (util-linux runuser), CVE-2016-2568 (pkexec)
>
> I am not sure if the pkexec vulnerability is even fixed:
>
> https://bugzilla.redhat.com/show_bug.cgi?id=1300746
>
> CVE-2017-5226 is for bubblewrap/flatpak this year, and I'm sure there
> were a lot more as I didn't bother to dig very deep.
>
> I completely agree that it should be solved by doing things properly in
> each application. However, it isn't solved properly everywhere and each
> new application is making the same mistake. Providing this feature does
> not break anything that people use in practice and it doesn't need to
> solve every issue to be quite useful, it only needs to prevent local
> privilege escalation in the form of code execution in many cases. Is
> there another way to get code execution via that bubblewrap/flatpak bug
> with this feature implemented? As far as I can tell, there isn't. It's a
> problem even with this feature but a significantly less serious one.
>



-- 
Boris Lukashev
Systems Architect
Semper Victus

[-- Attachment #2: Type: text/html, Size: 4713 bytes --]