Messages in this thread | | | Subject | Re: [kernel-hardening] Re: [PATCH v7 2/2] security: tty: make TIOCSTI ioctl require CAP_SYS_ADMIN | From | Matt Brown <> | Date | Sat, 3 Jun 2017 18:22:56 -0400 |
| |
On 06/03/2017 06:00 PM, Alan Cox wrote: >> TIOCSLCKTRMIOS > > That one I'm more dubious about > >> TIOCSLTC >> TIOCSSOFTCAR > > tty_io.c also has a few and n_tty has a couple we'd want. > >> >> would it be overkill to have a sysctl kernel.ttyioctlwhitelist.X where X >> is one of the ioctls above? > > Why would anyone want to change the entries on that list >
Did you see Serge's proposed solution? I want us to not be talking past each other. Serge proposed the following:
| By default, nothing changes - you can use those on your own tty, need | CAP_SYS_ADMIN against init_user_ns otherwise. | | Introduce a new CAP_TTY_PRIVILEGED. | | When may_push_chars is removed from the whitelist, you lose the | ability to use TIOCSTI on a tty - even your own - if you do not have | CAP_TTY_PRIVILEGED against the tty's user_ns.
The question is how do you add/remove something from this whitelist? I assume by add/remove we don't mean that you have to recompile your kernel to change the whitelist!
you earlier said you wanted the check to look like this:
| if (!whitelisted(ioctl) && different_namespace && magic_flag)
I want to know which namespace you are talking about here. Did you mean user_namespace? (the namespace I added tracking for in the tty_struct)
| |