Re: [Security] kernel allows loadkeys to be used by any user, allowing for local root compromise

[Andrew Morton <akpm@osdl.org>]

Horms <horms@verge.net.au> wrote:
>
> drivers/char/vt_ioctl.c: vt_ioctl(): line 377
> 
>          /*
>           * To have permissions to do most of the vt ioctls, we either
>           * have
>           * to be the owner of the tty, or have CAP_SYS_TTY_CONFIG.
>           */
>          perm = 0;
>          if (current->signal->tty == tty || capable(CAP_SYS_TTY_CONFIG))
>                  perm = 1;
> 
> 
>  A simple fix for this might be just checking for capable(CAP_SYS_TTY_CONFIG)
>  in do_kdgkb_ioctl(), which effects KDSKBSENT. This more restrictive
>  approach is probably appropriate for many of the other ioctls that set
>  VT parameters.

I briefly discussed this with Alan and he agreed that that's a reasonable
approach.

I'll stick the below in -mm, see what breaks.

--- devel/drivers/char/vt_ioctl.c~setkeys-needs-root	2005-10-17 23:50:37.000000000 -0700
+++ devel-akpm/drivers/char/vt_ioctl.c	2005-10-17 23:51:43.000000000 -0700
@@ -192,6 +192,9 @@ do_kdgkb_ioctl(int cmd, struct kbsentry 
 	int i, j, k;
 	int ret;
 
+	if (!capable(CAP_SYS_TTY_CONFIG))
+		return -EPERM;
+
 	kbs = kmalloc(sizeof(*kbs), GFP_KERNEL);
 	if (!kbs) {
 		ret = -ENOMEM;
_