lkml.org 
[lkml]   [2005]   [Oct]   [18]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    Date
    From
    SubjectRe: [Security] kernel allows loadkeys to be used by any user, allowing for local root compromise
    Horms <horms@verge.net.au> wrote:
    >
    > drivers/char/vt_ioctl.c: vt_ioctl(): line 377
    >
    > /*
    > * To have permissions to do most of the vt ioctls, we either
    > * have
    > * to be the owner of the tty, or have CAP_SYS_TTY_CONFIG.
    > */
    > perm = 0;
    > if (current->signal->tty == tty || capable(CAP_SYS_TTY_CONFIG))
    > perm = 1;
    >
    >
    > A simple fix for this might be just checking for capable(CAP_SYS_TTY_CONFIG)
    > in do_kdgkb_ioctl(), which effects KDSKBSENT. This more restrictive
    > approach is probably appropriate for many of the other ioctls that set
    > VT parameters.

    I briefly discussed this with Alan and he agreed that that's a reasonable
    approach.

    I'll stick the below in -mm, see what breaks.

    --- devel/drivers/char/vt_ioctl.c~setkeys-needs-root 2005-10-17 23:50:37.000000000 -0700
    +++ devel-akpm/drivers/char/vt_ioctl.c 2005-10-17 23:51:43.000000000 -0700
    @@ -192,6 +192,9 @@ do_kdgkb_ioctl(int cmd, struct kbsentry
    int i, j, k;
    int ret;

    + if (!capable(CAP_SYS_TTY_CONFIG))
    + return -EPERM;
    +
    kbs = kmalloc(sizeof(*kbs), GFP_KERNEL);
    if (!kbs) {
    ret = -ENOMEM;
    _
    -
    To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
    the body of a message to majordomo@vger.kernel.org
    More majordomo info at http://vger.kernel.org/majordomo-info.html
    Please read the FAQ at http://www.tux.org/lkml/

    \
     
     \ /
      Last update: 2005-10-18 08:57    [W:0.022 / U:119.960 seconds]
    ©2003-2016 Jasper Spaans. hosted at Digital OceanAdvertise on this site