Date: Fri, 1 Sep 2017 12:07:16 -0400 From: Rich Felker <dalias@...c.org> To: musl@...ts.openwall.com Subject: Re: [PATCH 0/1] openpty: use TIOCGPTPEER to open slave side fd On Fri, Sep 01, 2017 at 12:00:49PM -0400, Rich Felker wrote: > On Fri, Sep 01, 2017 at 05:35:57PM +0200, Christian Brauner wrote: > > Hi, > > > > Newer kernels expose the ioctl TIOCGPTPEER  call to userspace which allows to > > safely allocate a file descriptor for a pty slave based solely on the master > > file descriptor. This allows us to avoid path-based operations and makes this > > function a lot safer in the face of devpts mounts in different mount namespaces. > > > > : https://patchwork.kernel.org/patch/9760743/ > > > [....] > Otherwise this looks like a good change, but I do wonder a bit about > how the cases where it would help are intended to work, since the Actually I'm also rather concerned about security of this whole kernel patch in general. Consider the case where a daemon running as root performs posix_openpt, chowns the corresponding ptsname to a user and hands the pts off to a user process, then drops from root to nobody, possibly after chrooting itself or similar. In this scenario it should not be able to open the user's pts, but with TIOCGPTPEER it can bypass the filesystem permissions and open it. I'm not sure what mischief this lets you achieve, but it seems like a violation of an important permissions invariant... Rich
Powered by blists - more mailing lists
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.