Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
Date:   Tue, 13 Jun 2023 12:24:14 +0200
From:   Greg KH <gregkh@linuxfoundation.org>
To:     Michal Sekletar <msekleta@redhat.com>
Cc:     jirislaby@kernel.org, arozansk@redhat.com,
        linux-kernel@vger.kernel.org, linux-kselftest@vger.kernel.org,
        shuah@kernel.org
Subject: Re: [PATCH v2 1/2] tty: tty_io: update timestamps on all device nodes
Message-ID: <2023061359-document-armband-d67d@gregkh>
References: <c91c458e-58d0-f13a-9adb-a48a19f82107@kernel.org>
 <20230608101616.44152-1-msekleta@redhat.com>
 <2023060816-quicken-around-d619@gregkh>
 <CALVzVJas7g8PrTavpQ01J4vpKtqNP7fYznMMXYEM4K5XbbXRhg@mail.gmail.com>
 <2023061325-alibi-grappling-c764@gregkh>
MIME-Version: 1.0
Content-Type: text/plain; charset=utf-8
Content-Disposition: inline
Content-Transfer-Encoding: 8bit
In-Reply-To: <2023061325-alibi-grappling-c764@gregkh>
Precedence: bulk

On Tue, Jun 13, 2023 at 12:23:41PM +0200, Greg KH wrote:
> On Thu, Jun 08, 2023 at 07:52:54PM +0200, Michal Sekletar wrote:
> > On Thu, Jun 8, 2023 at 1:51 PM Greg KH <gregkh@linuxfoundation.org> wrote:
> > 
> > > So how are you protecting this from being an information leak like we
> > > have had in the past where you could monitor how many characters were
> > > being sent to the tty through a proc file?  Seems like now you can just
> > > monitor any tty node in the system and get the same information, while
> > > today you can only do it for the tty devices you have permissions for,
> > > right?
> > 
> > Hi Greg,
> > 
> > I am not protecting against it in any way, but proposed changes are only
> > about timestamp updates which still happen in at least 8 seconds intervals
> > so exact timing of read/writes to tty can't be inferred. Frankly, I may
> > have misunderstood something. It would be great if you could mention a bit
> > more details about CVE you had in mind.
> 
> Ah, I missed that this is in 8 second increments, nevermind then!
> 

Note, I still can't take this series for the obvious reason in patch
2/2.  Please fix.

thanks,

greg k-h