Date: Tue, 25 Apr 2017 15:56:32 +0200 From: Jann Horn <jannh@...gle.com> To: Alan Cox <gnomes@...rguk.ukuu.org.uk> Cc: Matt Brown <matt@...tt.com>, serge@...lyn.com, jmorris@...ei.org, Greg Kroah-Hartman <gregkh@...uxfoundation.org>, jslaby@...e.com, Jonathan Corbet <corbet@....net>, Kees Cook <keescook@...omium.org>, Andrew Morton <akpm@...ux-foundation.org>, kernel-hardening@...ts.openwall.com, linux-security-module@...r.kernel.org, linux-kernel@...r.kernel.org, linux-doc@...r.kernel.org Subject: Re: [PATCH v5 0/2] security: tty: make TIOCSTI ioctl require CAP_SYS_ADMIN On Tue, Apr 25, 2017 at 3:47 PM, Alan Cox <gnomes@...rguk.ukuu.org.uk> wrote: >> There could be a few user programs that would be effected by this >> change. >> See: <https://codesearch.debian.net/search?q=ioctl%5C%28.*TIOCSTI> >> notable programs are: agetty, csh, xemacs and tcsh >> >> However, I still believe that this change is worth it given that the >> Kconfig defaults to n. This will be a feature that is turned on for the >> same reason that people activate it when using grsecurity. Users of this >> opt-in feature will realize that they are choosing security over some OS >> features > > Only in this case they are not. > > If I am at the point I have the ability to send you TIOCSTI you already > lost because I can just open /dev/tty to get access to my controlling tty > and use write(). In terms of PTYs, this patch does not try to prevent writes to a slave device (which afaik is what /dev/tty will give you). It tries to prevent the equivalent of writes to the master device. As far as I know, there is no way to go from a slave to the corresponding master without having access to the master in some other way already.
Powered by blists - more mailing lists
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.