linux-kernel - Re: um: TTY fixes (?)

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20120605121532.366a6526@pyramind.ukuu.org.uk>
Date:	Tue, 5 Jun 2012 12:15:32 +0100
From:	Alan Cox <alan@...rguk.ukuu.org.uk>
To:	Karel Zak <kzak@...hat.com>
Cc:	Richard Weinberger <richard@....at>, jslaby@...e.cz,
	user-mode-linux-devel@...ts.sourceforge.net,
	gregkh@...uxfoundation.org, linux-kernel@...r.kernel.org,
	viro@...iv.linux.org.uk, alan@...ux.intel.com
Subject: Re: um: TTY fixes (?)

>  open_tty() closes all the old file descriptors after tty open:

It needs to close them before.
> 
>     vhangup();
>     ...
> 	fd = open(tty, O_RDWR | O_NONBLOCK);
>     ...
> 
> 	flags = fcntl(fd, F_GETFL);
> 	flags &= ~O_NONBLOCK;
> 	fcntl(fd, F_SETFL, flags);
> 
> 	for (i = 0; i < fd; i++)
> 		close(i);
> 	for (i = 0; i < 3; i++)
> 		if (fd != i)
> 			dup2(fd, i);
> 	if (fd >= 3)
> 		close(fd);
> 
> we use this for pretty long time (17+ years).
> 
> > If I add:
> >         fclose(stdin);
> >         fclose(stdout);
> >         fclose(stderr);
> > before the call to vhangup() login works like charm. :-)
> > 
> > Karel, what do you think?
> 
>  It's probably no problem to close all the file descriptors before
>  vhangup(), but it would be nice to know why we need this change after
>  20 years :-)

Because we want to actually fix the standards (and security) violation
that means it has happened to work on the console for 20 years.

Actually I'd prefer a clever solution which can spot all the fds are the
same process so we can keep compatibility but I've not found a sensible
way to do that.

Alan
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/