Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S934257AbcDLSMw (ORCPT ); Tue, 12 Apr 2016 14:12:52 -0400 Received: from mail-ig0-f194.google.com ([209.85.213.194]:35378 "EHLO mail-ig0-f194.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S933476AbcDLSMt (ORCPT ); Tue, 12 Apr 2016 14:12:49 -0400 MIME-Version: 1.0 In-Reply-To: References: <878u0s3orx.fsf_-_@x220.int.ebiederm.org> <1459819769-30387-1-git-send-email-ebiederm@xmission.com> <87twjcorwg.fsf@x220.int.ebiederm.org> <20160409140909.42315e6d@lxorguk.ukuu.org.uk> <83FE8CD2-C0A2-4ADB-AEBD-8DD89AD4F88A@zytor.com> <87bn5ij0x1.fsf@x220.int.ebiederm.org> <78205895-E11D-417F-91DC-4BCA0B61A122@zytor.com> Date: Tue, 12 Apr 2016 11:12:37 -0700 X-Google-Sender-Auth: jqMGl6KQgyKT0-atTMSso8jVwpY Message-ID: Subject: Re: [PATCH 01/13] devpts: Teach /dev/ptmx to find the associated devpts via path lookup From: Linus Torvalds To: Andy Lutomirski Cc: security@debian.org, "security@kernel.org" , Al Viro , "security@ubuntu.com >> security" , Peter Hurley , "Eric W. Biederman" , Serge Hallyn , Willy Tarreau , Aurelien Jarno , One Thousand Gnomes , Jann Horn , Greg KH , Linux Kernel Mailing List , Jiri Slaby , Florian Weimer , "H. Peter Anvin" Content-Type: text/plain; charset=UTF-8 Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 1957 Lines: 49 On Tue, Apr 12, 2016 at 10:44 AM, Andy Lutomirski wrote: > Linus, you said that people who want to protect their pts should deny > execute. So I set it up: > > # ls -l > total 0 > crw-------. 1 root root 5, 2 Apr 12 10:38 ptmx > drwx------. 2 root root 0 Apr 2 11:35 pts No you didn't. You're root, and you still have access to /dev/ptmx. > And there goes your protection. So the whole /dev directory would > have to deny execute to protect against this. Exactly. That's what I'm saying. If you want your ptmx to be private, you need to make your /dev private. Now, you can avoid the other attack that was talked about (which involved bind-mounting the pts/ directory somewhere else) by making just the pts/ directory non-execute, because afaik bind mount requires the ability to do the lookup. > But I think that gating this on mount options might be fine. If > devpts is mounted with newinstance, then /dev/ptmx *already doesn't > work for it*, right? So can we just say that the magic ptmx -> > pts/ptmx redirect doesn't work if the pts filesystem in question is > mounted with newinstance? No, the problem that started this whole discussion is that (a) newinstance should go the f*ck away, because this whole duality is broken. (b) people wanted single instances and we couldn't even enable default kernel support for DEVPTS_MULTIPLE_INSTANCES, because multiple instances just don't work with /dev/ptmx. So what I want to happen is to "just make /dev/ptmx work". Get rid of the broken "single instance" crap. The only reason it exists is exactly because /dev/ptmx does not work. I think the current situation is completely and utterly broken. We should never have done what we did. I want to *fix* the kernel, not add random new magic crap. And I think we _can_ fix the kernel. Not add new mount options that people already don't use (because they are broken for the normal situation). Linus