linux-kernel - [PATCH] tty: Allow stealing of controlling ttys within user namespaces

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date:	Tue, 21 Jan 2014 14:22:23 -0600
From:	Seth Forshee <seth.forshee@...onical.com>
To:	Greg Kroah-Hartman <gregkh@...uxfoundation.org>,
	Jiri Slaby <jslaby@...e.cz>
Cc:	Seth Forshee <seth.forshee@...onical.com>,
	Serge Hallyn <serge.hallyn@...onical.com>,
	"Eric W. Biederman" <ebiederm@...ssion.com>,
	linux-kernel@...r.kernel.org
Subject: [PATCH] tty: Allow stealing of controlling ttys within user namespaces

root is allowed to steal ttys from other sessions, but it
requires system-wide CAP_SYS_ADMIN and therefore is not possible
for root within a user namespace. This should be allowed so long
as the process doing the stealing is privileged towards the
session leader which currently owns the tty.

Update the tty code to only require CAP_SYS_ADMIN in the
namespace of the target session leader when stealing a tty. Fall
back to using init_user_ns to preserve the existing behavior for
system-wide root.

Cc: stable@...r.kernel.org # 3.8+
Cc: Serge Hallyn <serge.hallyn@...onical.com>
Cc: "Eric W. Biederman" <ebiederm@...ssion.com>
Signed-off-by: Seth Forshee <seth.forshee@...onical.com>
---
 drivers/tty/tty_io.c | 14 +++++++++++++-
 1 file changed, 13 insertions(+), 1 deletion(-)

diff --git a/drivers/tty/tty_io.c b/drivers/tty/tty_io.c
index c74a00a..1c47f16 100644
--- a/drivers/tty/tty_io.c
+++ b/drivers/tty/tty_io.c
@@ -2410,7 +2410,19 @@ static int tiocsctty(struct tty_struct *tty, int arg)
 		 * This tty is already the controlling
 		 * tty for another session group!
 		 */
-		if (arg == 1 && capable(CAP_SYS_ADMIN)) {
+		struct user_namespace *ns = &init_user_ns;
+		struct task_struct *p;
+
+		read_lock(&tasklist_lock);
+		do_each_pid_task(tty->session, PIDTYPE_SID, p) {
+			if (p->signal->leader) {
+				ns = task_cred_xxx(p, user_ns);
+				break;
+			}
+		} while_each_pid_task(tty->session, PIDTYPE_SID, p);
+		read_unlock(&tasklist_lock);
+
+		if (arg == 1 && ns_capable(ns, CAP_SYS_ADMIN)) {
 			/*
 			 * Steal it away
 			 */
-- 
1.8.3.2

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/