Re: [PATCH] tty: Require CAP_SYS_ADMIN for all usages of TIOCL_SELMOUSEREPORT

["Günther Noack" <gnoack3000@gmail.com>]

Hello Greg!

On Fri, Mar 07, 2025 at 12:05:43PM +0100, Greg Kroah-Hartman wrote:
> On Fri, Mar 07, 2025 at 11:16:21AM +0100, Günther Noack wrote:
> > On Sun, Feb 23, 2025 at 09:54:50PM +0100, Günther Noack wrote:
> > > This requirement was overeagerly loosened in commit 2f83e38a095f
> > > ("tty: Permit some TIOCL_SETSEL modes without CAP_SYS_ADMIN"), but as
> > > it turns out,
> > > 
> > >   (1) the logic I implemented there was inconsistent (apologies!),
> > > 
> > >   (2) TIOCL_SELMOUSEREPORT might actually be a small security risk
> > >       after all, and
> > > 
> > >   (3) TIOCL_SELMOUSEREPORT is only meant to be used by the mouse
> > >       daemon (GPM or Consolation), which runs as CAP_SYS_ADMIN
> > >       already.
> > 
> > 
> > Greg and Jared: Friendly ping on this patch.
> 
> I think my bot found a problem with the v2 version so I was waiting for
> a new one to meet the issues there, right?

I made a submission mistake with the previous patch, which your bot
tripped over, but you already merged it into master and stable as
commit 2f83e38a095f ("tty: Permit some TIOCL_SETSEL modes without
CAP_SYS_ADMIN"):
https://lore.kernel.org/all/2025011205-spinout-rewrap-2dfa@gregkh/

The patch I am submitting here is a new bugfix on top, for which I am
seeking your approval, since the previous patch is already merged.  (I
should have sent it as a new mail thread, I guess. :-/)

(If that helps, I explained the relationship between these different
patches more visually in the table in
https://lore.kernel.org/all/20250307.9339126c0c96@gnoack.org/.)

Thanks,
–Günther