linux-kernel - Re: [PATCH v5 0/2] security: tty: make TIOCSTI ioctl require CAP_SYS

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <CAG48ez0uYkAg65iBZ8cKLxzFyEK=Axt=NP7jnmQkFp4rN=0GzA@mail.gmail.com>
Date:   Tue, 25 Apr 2017 15:56:32 +0200
From:   Jann Horn <jannh@...gle.com>
To:     Alan Cox <gnomes@...rguk.ukuu.org.uk>
Cc:     Matt Brown <matt@...tt.com>, serge@...lyn.com, jmorris@...ei.org,
        Greg Kroah-Hartman <gregkh@...uxfoundation.org>,
        jslaby@...e.com, Jonathan Corbet <corbet@....net>,
        Kees Cook <keescook@...omium.org>,
        Andrew Morton <akpm@...ux-foundation.org>,
        kernel-hardening@...ts.openwall.com,
        linux-security-module@...r.kernel.org,
        linux-kernel@...r.kernel.org, linux-doc@...r.kernel.org
Subject: Re: [PATCH v5 0/2] security: tty: make TIOCSTI ioctl require CAP_SYS_ADMIN

On Tue, Apr 25, 2017 at 3:47 PM, Alan Cox <gnomes@...rguk.ukuu.org.uk> wrote:
>> There could be a few user programs that would be effected by this
>> change.
>> See: <https://codesearch.debian.net/search?q=ioctl%5C%28.*TIOCSTI>
>> notable programs are: agetty, csh, xemacs and tcsh
>>
>> However, I still believe that this change is worth it given that the
>> Kconfig defaults to n. This will be a feature that is turned on for the
>> same reason that people activate it when using grsecurity. Users of this
>> opt-in feature will realize that they are choosing security over some OS
>> features
>
> Only in this case they are not.
>
> If I am at the point I have the ability to send you TIOCSTI you already
> lost because I can just open /dev/tty to get access to my controlling tty
> and use write().

In terms of PTYs, this patch does not try to prevent writes to a slave
device (which afaik is what /dev/tty will give you). It tries to prevent the
equivalent of writes to the master device. As far as I know, there is no
way to go from a slave to the corresponding master without having
access to the master in some other way already.