linux-kernel - Re: [kernel-hardening] Re: [PATCH v7 2/2] security: tty: make TIOCSTI ioctl require CAP_SYS

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <CAGXu5j+pqD1082fYDS_dvDB2QNvt9wSz+C7vAhGpMXcJWxoDkw@mail.gmail.com>
Date:   Wed, 31 May 2017 19:35:55 -0700
From:   Kees Cook <keescook@...omium.org>
To:     Alan Cox <gnomes@...rguk.ukuu.org.uk>
Cc:     Matt Brown <matt@...tt.com>,
        Casey Schaufler <casey@...aufler-ca.com>,
        Boris Lukashev <blukashev@...pervictus.com>,
        Greg KH <gregkh@...uxfoundation.org>,
        "Serge E. Hallyn" <serge@...lyn.com>,
        "kernel-hardening@...ts.openwall.com" 
        <kernel-hardening@...ts.openwall.com>,
        linux-security-module <linux-security-module@...r.kernel.org>,
        linux-kernel <linux-kernel@...r.kernel.org>
Subject: Re: [kernel-hardening] Re: [PATCH v7 2/2] security: tty: make TIOCSTI
 ioctl require CAP_SYS_ADMIN

On Tue, May 30, 2017 at 4:56 PM, Alan Cox <gnomes@...rguk.ukuu.org.uk> wrote:
>> This is my point. Apps will continue to shoot themselves in the foot. Of course
>> the correct response to one of these vulns is to not pass ttys across a
>> security boundary. We have an opportunity here to reduce the impact of this bug
>> class at the kernel level.
>
> Not really.
>
> If you pass me your console for example I can mmap your framebuffer and
> spy on you all day. Or I could reprogram your fonts, your keyboard, your
> video mode, or use set and paste selection to write stuff. If you are
> using X and you can't get tty handles right you'll no doubt pass me a
> copy of your X file descriptor in which case I own your display, your
> keyboard and your mouse and I don't need to use TIOCSTI there either.
>
> There are so many different attacks based upon that screwup that the
> kernel cannot defend against them. You aren't exactly reducing the impact.

I still cannot wrap my head around why providing users with a
protection is a bad thing. Yes, the other tty games are bad, but this
fixes a specific and especially bad case that is easy to kill. It's
got a Kconfig and a sysctl. It's not on by default. This protects the
common case of privileged ttys that aren't attached to consoles, etc,
so while the framebuffer thing is an issue, it's not always an issue,
etc.

I'd like to hear Greg's thoughts on this series...

-Kees

-- 
Kees Cook
Pixel Security