Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1757222AbcDLRpN (ORCPT ); Tue, 12 Apr 2016 13:45:13 -0400 Received: from mail-oi0-f52.google.com ([209.85.218.52]:35397 "EHLO mail-oi0-f52.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1756084AbcDLRpL (ORCPT ); Tue, 12 Apr 2016 13:45:11 -0400 MIME-Version: 1.0 In-Reply-To: References: <878u0s3orx.fsf_-_@x220.int.ebiederm.org> <1459819769-30387-1-git-send-email-ebiederm@xmission.com> <87twjcorwg.fsf@x220.int.ebiederm.org> <20160409140909.42315e6d@lxorguk.ukuu.org.uk> <83FE8CD2-C0A2-4ADB-AEBD-8DD89AD4F88A@zytor.com> <87bn5ij0x1.fsf@x220.int.ebiederm.org> <78205895-E11D-417F-91DC-4BCA0B61A122@zytor.com> From: Andy Lutomirski Date: Tue, 12 Apr 2016 10:44:50 -0700 Message-ID: Subject: Re: [PATCH 01/13] devpts: Teach /dev/ptmx to find the associated devpts via path lookup To: Linus Torvalds Cc: security@debian.org, "security@kernel.org" , Al Viro , "security@ubuntu.com >> security" , Peter Hurley , "Eric W. Biederman" , Serge Hallyn , Willy Tarreau , Aurelien Jarno , One Thousand Gnomes , Jann Horn , Greg KH , Linux Kernel Mailing List , Jiri Slaby , Florian Weimer , "H. Peter Anvin" Content-Type: text/plain; charset=UTF-8 Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 2088 Lines: 57 On Mon, Apr 11, 2016 at 1:12 PM, Andy Lutomirski wrote: > On Sat, Apr 9, 2016 at 6:27 PM, Linus Torvalds > wrote: >> >> On Apr 9, 2016 5:45 PM, "Andy Lutomirski" wrote: >>> >>> >>> What we *do* want to do, though, is to prevent the following: >> >> I don't see the point. Why do you bring up this insane scenario that nobody >> can possibly care about? >> >> So you actually have any reason to believe somebody does that? >> >> I already asked about that earlier, and the silence was deafening. > > I have no idea, but I'm generally uncomfortable with magical things > that bypass normal security policy. > > That being said, here's an idea for fixing this, at least in the long > run. Add a new devpts mount option "no_ptmx_redirect" that turns off > this behavior for the super in question. That is, opening /dev/ptmx > if "pts/ptmx" points to something with no_ptmx_redirect set will fail. > Distros shipping new kernels could be encouraged to (finally!) make > /dev/ptmx a symlink and set this option. > > We just might be able to get away with spelling that option "newinstance". Linus, you said that people who want to protect their pts should deny execute. So I set it up: # ls -l total 0 crw-------. 1 root root 5, 2 Apr 12 10:38 ptmx drwx------. 2 root root 0 Apr 2 11:35 pts $ unshare -urm # ls -l total 0 crw-------. 1 nfsnobody nfsnobody 5, 2 Apr 12 10:38 ptmx drwx------. 2 nfsnobody nfsnobody 0 Apr 2 11:35 pts # mount --bind /dev/ptmx ptmx # ls -l total 0 crw-rw-rw-. 1 nfsnobody nfsnobody 5, 2 Apr 12 10:42 ptmx drwx------. 2 nfsnobody nfsnobody 0 Apr 2 11:35 pts And there goes your protection. So the whole /dev directory would have to deny execute to protect against this. But I think that gating this on mount options might be fine. If devpts is mounted with newinstance, then /dev/ptmx *already doesn't work for it*, right? So can we just say that the magic ptmx -> pts/ptmx redirect doesn't work if the pts filesystem in question is mounted with newinstance? --Andy