Re: 8250 serial console fixes -- issue

From: Russell King <rmk+lkml@arm.linux.org.uk>
To: Pavel Machek <pavel@ucw.cz>
Cc: Glen Turner <glen.turner@aarnet.edu.au>,
	Alan Cox <alan@lxorguk.ukuu.org.uk>,
	Kumar Gala <galak@kernel.crashing.org>,
	linux-kernel@vger.kernel.org
Subject: Re: 8250 serial console fixes -- issue
Date: Mon, 6 Feb 2006 20:55:00 +0000	[thread overview]
Message-ID: <20060206205459.GB9388@flint.arm.linux.org.uk> (raw)
In-Reply-To: <20060206202654.GC2470@ucw.cz>

On Mon, Feb 06, 2006 at 08:26:55PM +0000, Pavel Machek wrote:
> Hi!
> 
> > > The serial console driver has a host of issues
> > > 
> > > [...]
> > > 
> > >  - [SECURITY] 'r' should require DCD to be asserted
> > >    before outputing characters. Otherwise we talk to
> > >    Hayes modem command mode.  This allows a non-root
> > >    user to re-program the modem and is a major security
> > >    issue is people configure calling line identification
> > >    or encryption to restrict use of the serial console.
> > 
> > How is this possible?  A normal user can't produce arbitarily formatted
> > kernel messages, and if they have access to /dev/ttyS they can do what
> > ever they like with the port anyway.
> 
> Maybe not *arbitrary* messages, but any user probably can fake enough
> to
> confuse modem. Name your process \nATD609123456\n and cause it to eat
> all memory, or something like that. OOM killer will print name...

As I say, it's a problem which needs fixing elsewhere.  What if
the process was called:

\nSystem Halted\n

(which will fit in the kernel's process name.)  Or maybe some escape
sequence which reprograms your terminal.

As I say, this is a problem which needs solving by other means.  Maybe
flush_old_exec() should be a little more careful about what it copies,
changing non-alphanumeric characters to '?' ?

-- 
Russell King
 Linux kernel    2.6 ARM Linux   - http://www.arm.linux.org.uk/
 maintainer of:  2.6 Serial core