Messages in this thread | | | Date | Tue, 18 Oct 2005 17:59:10 +0900 | From | Horms <> | Subject | Re: [Security] kernel allows loadkeys to be used by any user, allowing for local root compromise |
| |
On Mon, Oct 17, 2005 at 11:52:11PM -0700, Andrew Morton wrote: > Horms <horms@verge.net.au> wrote: > > > > drivers/char/vt_ioctl.c: vt_ioctl(): line 377 > > > > /* > > * To have permissions to do most of the vt ioctls, we either > > * have > > * to be the owner of the tty, or have CAP_SYS_TTY_CONFIG. > > */ > > perm = 0; > > if (current->signal->tty == tty || capable(CAP_SYS_TTY_CONFIG)) > > perm = 1; > > > > > > A simple fix for this might be just checking for capable(CAP_SYS_TTY_CONFIG) > > in do_kdgkb_ioctl(), which effects KDSKBSENT. This more restrictive > > approach is probably appropriate for many of the other ioctls that set > > VT parameters. > > I briefly discussed this with Alan and he agreed that that's a reasonable > approach.
Thanks, thats pretty much what I had in mind. Though I would expect some minor breakage, at least for people who expect nonsetuid loadkeys to work. But then again, that is the whole point.
> I'll stick the below in -mm, see what breaks. > > --- devel/drivers/char/vt_ioctl.c~setkeys-needs-root 2005-10-17 23:50:37.000000000 -0700 > +++ devel-akpm/drivers/char/vt_ioctl.c 2005-10-17 23:51:43.000000000 -0700 > @@ -192,6 +192,9 @@ do_kdgkb_ioctl(int cmd, struct kbsentry > int i, j, k; > int ret; > > + if (!capable(CAP_SYS_TTY_CONFIG)) > + return -EPERM; > + > kbs = kmalloc(sizeof(*kbs), GFP_KERNEL); > if (!kbs) { > ret = -ENOMEM; > _
-- Horms - To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
| |