Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1751327AbdFARSz (ORCPT ); Thu, 1 Jun 2017 13:18:55 -0400 Received: from h2.hallyn.com ([78.46.35.8]:49370 "EHLO h2.hallyn.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751230AbdFARSx (ORCPT ); Thu, 1 Jun 2017 13:18:53 -0400 Date: Thu, 1 Jun 2017 12:18:58 -0500 From: "Serge E. Hallyn" To: Alan Cox Cc: Kees Cook , Matt Brown , Casey Schaufler , Boris Lukashev , Greg KH , "Serge E. Hallyn" , "kernel-hardening@lists.openwall.com" , linux-security-module , linux-kernel Subject: Re: [kernel-hardening] Re: [PATCH v7 2/2] security: tty: make TIOCSTI ioctl require CAP_SYS_ADMIN Message-ID: <20170601171858.GA19604@mail.hallyn.com> References: <0e078ce7-5b62-f27c-3920-efc2ffdf342b@nmatt.com> <20170530132427.016053da@alans-desktop> <2ab8580e-bf8e-21bd-6bfa-33e5fa82400b@nmatt.com> <20170530235106.11aab25c@alans-desktop> <3bd4ff7b-6f7d-52b0-03f6-026bac79f11f@nmatt.com> <20170531005633.484a2e14@alans-desktop> <20170601140812.583cf0a5@alans-desktop> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <20170601140812.583cf0a5@alans-desktop> User-Agent: Mutt/1.5.21 (2010-09-15) Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 1802 Lines: 43 Quoting Alan Cox (gnomes@lxorguk.ukuu.org.uk): > > I still cannot wrap my head around why providing users with a > > protection is a bad thing. Yes, the other tty games are bad, but this > > fixes a specific and especially bad case that is easy to kill. It's > > got a Kconfig and a sysctl. It's not on by default. This protects the > > common case of privileged ttys that aren't attached to consoles, etc, > > Which just leads to stuff not getting fixed. Like all the code out there > today which is still vulnerable to selection based attacks because people > didn't do the job right when "fixing" stuff because they are not > thinking about security at a systems level but just tickboxing CVEs. > > I'm not against doing something to protect the container folks, but that > something as with Android is a whitelist of ioctls. And if we need to do Whitelist of ioctls (at least using seccomp) is not sufficient because then we have to turn the ioctl always-off. But like you say we may want to enable it for ptys which are created inside the container's user ns. > this with a kernel hook lets do it properly. > > Remember the namespace of the tty on creation Matt's patch does this, > If the magic security flag is set then > Apply a whitelist to *any* tty ioctl call where the ns doesn't > match Seems sensible. > and we might as well just take the Android whitelist since they've kindly > built it for us all! > > In the tty layer it ends up being something around 10 lines of code and > some other file somewhere in security/ that's just a switch or similar > with the whitelisted ioctl codes in it. > > That (or a similar SELinux ruleset) would actually fix the problem. > SELinux would be better because it can also apply the rules when doing > things like su/sudo/... > > Alan