* [PATCH 0/2] tty: Allow TIOCSTI to be disabled
@ 2022-10-15 4:16 Kees Cook
2022-10-15 4:16 ` [PATCH 1/2] tty: Move sysctl setup into "core" tty logic Kees Cook
2022-10-15 4:16 ` [PATCH 2/2] tty: Allow TIOCSTI to be disabled Kees Cook
0 siblings, 2 replies; 3+ messages in thread
From: Kees Cook @ 2022-10-15 4:16 UTC (permalink / raw)
To: Greg Kroah-Hartman
Cc: Kees Cook, Jiri Slaby, Simon Brand, linux-kernel, linux-hardening
Hi,
This is so very long over-due. We just need to do this and put an end
to this legacy operation.
Repeating the commit log from patch 2:
TIOCSTI continues its long history of being used in privilege escalation
attacks[1]. Prior attempts to provide a mechanism to disable this have
devolved into discussions around creating full-blown LSMs to provide
arbitrary ioctl filtering, which is hugely over-engineered -- only
TIOCSTI is being used this way. 3 years ago OpenBSD entirely removed
TIOCSTI[2], Android has had it filtered for longer[3], and the tools that
had historically used TIOCSTI either do not need it, are not commonly
built with it, or have had its use removed.
Provide a simple CONFIG and global sysctl to disable this for the system
builders who have wanted this functionality for literally decades now,
much like the ldisc_autoload CONFIG and sysctl.
[1] https://lore.kernel.org/linux-hardening/Y0m9l52AKmw6Yxi1@hostpad
[2] https://undeadly.org/cgi?action=article;sid=20170701132619
[3] https://lore.kernel.org/lkml/CAFJ0LnFGRuEEn1tCLhoki8ZyWrKfktbF+rwwN7WzyC_kBFoQVA@mail.gmail.com/
Thanks,
-Kees
Kees Cook (2):
tty: Move sysctl setup into "core" tty logic
tty: Allow TIOCSTI to be disabled
drivers/tty/Kconfig | 19 +++++++++++++++++
drivers/tty/tty.h | 2 +-
drivers/tty/tty_io.c | 47 +++++++++++++++++++++++++++++++++++++++--
drivers/tty/tty_ldisc.c | 38 +--------------------------------
4 files changed, 66 insertions(+), 40 deletions(-)
--
2.34.1
^ permalink raw reply [flat|nested] 3+ messages in thread
* [PATCH 1/2] tty: Move sysctl setup into "core" tty logic
2022-10-15 4:16 [PATCH 0/2] tty: Allow TIOCSTI to be disabled Kees Cook
@ 2022-10-15 4:16 ` Kees Cook
2022-10-15 4:16 ` [PATCH 2/2] tty: Allow TIOCSTI to be disabled Kees Cook
1 sibling, 0 replies; 3+ messages in thread
From: Kees Cook @ 2022-10-15 4:16 UTC (permalink / raw)
To: Greg Kroah-Hartman
Cc: Kees Cook, Jiri Slaby, Simon Brand, linux-kernel, linux-hardening
In preparation for adding another sysctl to the tty subsystem, move the
tty setup code into the "core" tty code, which contains tty_init() itself.
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Cc: Jiri Slaby <jirislaby@kernel.org>
Signed-off-by: Kees Cook <keescook@chromium.org>
---
drivers/tty/tty.h | 2 +-
drivers/tty/tty_io.c | 34 ++++++++++++++++++++++++++++++++--
drivers/tty/tty_ldisc.c | 38 +-------------------------------------
3 files changed, 34 insertions(+), 40 deletions(-)
diff --git a/drivers/tty/tty.h b/drivers/tty/tty.h
index f310a8274df1..4938ed3a44a5 100644
--- a/drivers/tty/tty.h
+++ b/drivers/tty/tty.h
@@ -93,7 +93,7 @@ void tty_ldisc_release(struct tty_struct *tty);
int __must_check tty_ldisc_init(struct tty_struct *tty);
void tty_ldisc_deinit(struct tty_struct *tty);
-void tty_sysctl_init(void);
+int tty_ldisc_autoload;
/* tty_audit.c */
#ifdef CONFIG_AUDIT
diff --git a/drivers/tty/tty_io.c b/drivers/tty/tty_io.c
index 82a8855981f7..b397b223eada 100644
--- a/drivers/tty/tty_io.c
+++ b/drivers/tty/tty_io.c
@@ -3581,13 +3581,44 @@ void console_sysfs_notify(void)
sysfs_notify(&consdev->kobj, NULL, "active");
}
+static struct ctl_table tty_table[] = {
+ {
+ .procname = "ldisc_autoload",
+ .data = &tty_ldisc_autoload,
+ .maxlen = sizeof(tty_ldisc_autoload),
+ .mode = 0644,
+ .proc_handler = proc_dointvec,
+ .extra1 = SYSCTL_ZERO,
+ .extra2 = SYSCTL_ONE,
+ },
+ { }
+};
+
+static struct ctl_table tty_dir_table[] = {
+ {
+ .procname = "tty",
+ .mode = 0555,
+ .child = tty_table,
+ },
+ { }
+};
+
+static struct ctl_table tty_root_table[] = {
+ {
+ .procname = "dev",
+ .mode = 0555,
+ .child = tty_dir_table,
+ },
+ { }
+};
+
/*
* Ok, now we can initialize the rest of the tty devices and can count
* on memory allocations, interrupts etc..
*/
int __init tty_init(void)
{
- tty_sysctl_init();
+ register_sysctl_table(tty_root_table);
cdev_init(&tty_cdev, &tty_fops);
if (cdev_add(&tty_cdev, MKDEV(TTYAUX_MAJOR, 0), 1) ||
register_chrdev_region(MKDEV(TTYAUX_MAJOR, 0), 1, "/dev/tty") < 0)
@@ -3609,4 +3640,3 @@ int __init tty_init(void)
#endif
return 0;
}
-
diff --git a/drivers/tty/tty_ldisc.c b/drivers/tty/tty_ldisc.c
index 776d8a62f77c..e758f44729e7 100644
--- a/drivers/tty/tty_ldisc.c
+++ b/drivers/tty/tty_ldisc.c
@@ -117,7 +117,7 @@ static void put_ldops(struct tty_ldisc_ops *ldops)
raw_spin_unlock_irqrestore(&tty_ldiscs_lock, flags);
}
-static int tty_ldisc_autoload = IS_BUILTIN(CONFIG_LDISC_AUTOLOAD);
+int tty_ldisc_autoload = IS_BUILTIN(CONFIG_LDISC_AUTOLOAD);
/**
* tty_ldisc_get - take a reference to an ldisc
@@ -817,39 +817,3 @@ void tty_ldisc_deinit(struct tty_struct *tty)
tty_ldisc_put(tty->ldisc);
tty->ldisc = NULL;
}
-
-static struct ctl_table tty_table[] = {
- {
- .procname = "ldisc_autoload",
- .data = &tty_ldisc_autoload,
- .maxlen = sizeof(tty_ldisc_autoload),
- .mode = 0644,
- .proc_handler = proc_dointvec,
- .extra1 = SYSCTL_ZERO,
- .extra2 = SYSCTL_ONE,
- },
- { }
-};
-
-static struct ctl_table tty_dir_table[] = {
- {
- .procname = "tty",
- .mode = 0555,
- .child = tty_table,
- },
- { }
-};
-
-static struct ctl_table tty_root_table[] = {
- {
- .procname = "dev",
- .mode = 0555,
- .child = tty_dir_table,
- },
- { }
-};
-
-void tty_sysctl_init(void)
-{
- register_sysctl_table(tty_root_table);
-}
--
2.34.1
^ permalink raw reply related [flat|nested] 3+ messages in thread
* [PATCH 2/2] tty: Allow TIOCSTI to be disabled
2022-10-15 4:16 [PATCH 0/2] tty: Allow TIOCSTI to be disabled Kees Cook
2022-10-15 4:16 ` [PATCH 1/2] tty: Move sysctl setup into "core" tty logic Kees Cook
@ 2022-10-15 4:16 ` Kees Cook
1 sibling, 0 replies; 3+ messages in thread
From: Kees Cook @ 2022-10-15 4:16 UTC (permalink / raw)
To: Greg Kroah-Hartman
Cc: Kees Cook, Jiri Slaby, Simon Brand, linux-kernel, linux-hardening
TIOCSTI continues its long history of being used in privilege escalation
attacks[1]. Prior attempts to provide a mechanism to disable this have
devolved into discussions around creating full-blown LSMs to provide
arbitrary ioctl filtering, which is hugely over-engineered -- only
TIOCSTI is being used this way. 3 years ago OpenBSD entirely removed
TIOCSTI[2], Android has had it filtered for longer[3], and the tools that
had historically used TIOCSTI either do not need it, are not commonly
built with it, or have had its use removed.
Provide a simple CONFIG and global sysctl to disable this for the system
builders who have wanted this functionality for literally decades now,
much like the ldisc_autoload CONFIG and sysctl.
[1] https://lore.kernel.org/linux-hardening/Y0m9l52AKmw6Yxi1@hostpad
[2] https://undeadly.org/cgi?action=article;sid=20170701132619
[3] https://lore.kernel.org/lkml/CAFJ0LnFGRuEEn1tCLhoki8ZyWrKfktbF+rwwN7WzyC_kBFoQVA@mail.gmail.com/
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Cc: Jiri Slaby <jirislaby@kernel.org>
Cc: Simon Brand <simon.brand@postadigitale.de>
Signed-off-by: Kees Cook <keescook@chromium.org>
---
drivers/tty/Kconfig | 19 +++++++++++++++++++
drivers/tty/tty_io.c | 13 +++++++++++++
2 files changed, 32 insertions(+)
diff --git a/drivers/tty/Kconfig b/drivers/tty/Kconfig
index cc30ff93e2e4..d35fc068da74 100644
--- a/drivers/tty/Kconfig
+++ b/drivers/tty/Kconfig
@@ -149,6 +149,25 @@ config LEGACY_PTY_COUNT
When not in use, each legacy PTY occupies 12 bytes on 32-bit
architectures and 24 bytes on 64-bit architectures.
+config LEGACY_TIOCSTI
+ bool "Allow legacy TIOCSTI usage"
+ default y
+ help
+ Historically the kernel has allowed TIOCSTI, which will push
+ characters into a controlling TTY. This continues to be used
+ as a malicious privilege escalation mechanism, and provides no
+ meaningful real-world utility any more. Its use is considered
+ a dangerous legacy operation, and can be disabled on most
+ systems.
+
+ Say 'Y here only if you have confirmed that your system's
+ userspace depends on this functionality to continue operating
+ normally.
+
+ This functionality can be changed at runtime with the
+ dev.tty.legacy_tiocsti sysctl. This configuration option sets
+ the default value of the sysctl.
+
config LDISC_AUTOLOAD
bool "Automatically load TTY Line Disciplines"
default y
diff --git a/drivers/tty/tty_io.c b/drivers/tty/tty_io.c
index b397b223eada..29956c5d7778 100644
--- a/drivers/tty/tty_io.c
+++ b/drivers/tty/tty_io.c
@@ -2275,11 +2275,15 @@ static int tty_fasync(int fd, struct file *filp, int on)
* * Called functions take tty_ldiscs_lock
* * current->signal->tty check is safe without locks
*/
+int tty_legacy_tiocsti __read_mostly = IS_BUILTIN(CONFIG_LEGACY_TIOCSTI);
static int tiocsti(struct tty_struct *tty, char __user *p)
{
char ch, mbz = 0;
struct tty_ldisc *ld;
+ if (!tty_legacy_tiocsti)
+ return -EIO;
+
if ((current->signal->tty != tty) && !capable(CAP_SYS_ADMIN))
return -EPERM;
if (get_user(ch, p))
@@ -3582,6 +3586,15 @@ void console_sysfs_notify(void)
}
static struct ctl_table tty_table[] = {
+ {
+ .procname = "legacy_tiocsti",
+ .data = &tty_legacy_tiocsti,
+ .maxlen = sizeof(tty_legacy_tiocsti),
+ .mode = 0644,
+ .proc_handler = proc_dointvec,
+ .extra1 = SYSCTL_ZERO,
+ .extra2 = SYSCTL_ONE,
+ },
{
.procname = "ldisc_autoload",
.data = &tty_ldisc_autoload,
--
2.34.1
^ permalink raw reply related [flat|nested] 3+ messages in thread
end of thread, other threads:[~2022-10-15 4:16 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2022-10-15 4:16 [PATCH 0/2] tty: Allow TIOCSTI to be disabled Kees Cook
2022-10-15 4:16 ` [PATCH 1/2] tty: Move sysctl setup into "core" tty logic Kees Cook
2022-10-15 4:16 ` [PATCH 2/2] tty: Allow TIOCSTI to be disabled Kees Cook
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.