[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Mon, 28 Aug 2023 20:48:22 +0200
From: Greg KH <gregkh@...uxfoundation.org>
To: Mickaël Salaün <mic@...ikod.net>
Cc: Günther Noack <gnoack@...gle.com>,
Hanno Böck <hanno@...eck.de>,
kernel-hardening@...ts.openwall.com,
Kees Cook <keescook@...omium.org>,
Jiri Slaby <jirislaby@...nel.org>,
Geert Uytterhoeven <geert@...ux-m68k.org>,
Paul Moore <paul@...l-moore.com>,
Samuel Thibault <samuel.thibault@...-lyon.org>,
David Laight <David.Laight@...lab.com>,
Simon Brand <simon.brand@...tadigitale.de>,
Dave Mielke <Dave@...lke.cc>, KP Singh <kpsingh@...gle.com>,
Nico Schottelius <nico-gpm2008@...ottelius.org>
Subject: Re: [PATCH v3 1/1] tty: Restrict access to TIOCLINUX' copy-and-paste
subcommands
On Mon, Aug 28, 2023 at 08:43:39PM +0200, Mickaël Salaün wrote:
> On Mon, Aug 28, 2023 at 06:41:17PM +0200, Günther Noack wrote:
> > From: Hanno Böck <hanno@...eck.de>
> >
> > TIOCLINUX can be used for privilege escalation on virtual terminals when
> > code is executed via tools like su/sudo and sandboxing tools.
> >
> > By abusing the selection features, a lower-privileged application can
> > write content to the console, select and copy/paste that content and
> > thereby executing code on the privileged account. See also the poc
> > here:
> >
> > https://www.openwall.com/lists/oss-security/2023/03/14/3
> >
> > Selection is usually used by tools like gpm that provide mouse features
> > on the virtual console. gpm already runs as root (due to earlier
> > changes that restrict access to a user on the current TTY), therefore
> > it will still work with this change.
> >
> > With this change, the following TIOCLINUX subcommands require
> > CAP_SYS_ADMIN:
> >
> > * TIOCL_SETSEL - setting the selected region on the terminal
> > * TIOCL_PASTESEL - pasting the contents of the selected region into
> > the input buffer
> > * TIOCL_SELLOADLUT - changing word-by-word selection behaviour
> >
> > The security problem mitigated is similar to the security risks caused
> > by TIOCSTI, which, since kernel 6.2, can be disabled with
> > CONFIG_LEGACY_TIOCSTI=n.
> >
> > Signed-off-by: Hanno Böck <hanno@...eck.de>
> > Signed-off-by: Günther Noack <gnoack@...gle.com>
>
> The SoB rules are tricky, you cannot have a Signed-off-by if you are not
> in the From/Author or Committer or Co-Developed-by fields:
> https://docs.kernel.org/process/submitting-patches.html#when-to-use-acked-by-cc-and-co-developed-by
Not true at all, maintainers add their signed-off-by to everything they
apply, and you HAVE to add it to a patch that flows through you to
someone else, as per the DCO.
> It should be:
>
> Co-Developed-by: Günther Noack <gnoack@...gle.com>
Not if this person was not a developer on it, no.
> Signed-off-by: Günther Noack <gnoack@...gle.com>
> Signed-off-by: Hanno Böck <hanno@...eck.de>
>
> > Tested-by: Günther Noack <gnoack@...gle.com>
>
> This Tested-by should not be required anymore because of your SoB,
> which should implicitly stipulate that you tested this patch.
>
> I'm not sure if it's worth sending another version with only this fix
> though, if there is no more issue I guess the maintainer picking it
> could fix it.
As submitted, it is correct.
thanks,
greg k-h
Powered by blists - more mailing lists
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
