Re: [Security] kernel allows loadkeys to be used by any user, allowing for local root compromise

[Horms <horms@debian.org>]

On Mon, Oct 17, 2005 at 11:52:11PM -0700, Andrew Morton wrote:
> Horms <horms@verge.net.au> wrote:
> >
> > drivers/char/vt_ioctl.c: vt_ioctl(): line 377
> > 
> >          /*
> >           * To have permissions to do most of the vt ioctls, we either
> >           * have
> >           * to be the owner of the tty, or have CAP_SYS_TTY_CONFIG.
> >           */
> >          perm = 0;
> >          if (current->signal->tty == tty || capable(CAP_SYS_TTY_CONFIG))
> >                  perm = 1;
> > 
> > 
> >  A simple fix for this might be just checking for capable(CAP_SYS_TTY_CONFIG)
> >  in do_kdgkb_ioctl(), which effects KDSKBSENT. This more restrictive
> >  approach is probably appropriate for many of the other ioctls that set
> >  VT parameters.
> 
> I briefly discussed this with Alan and he agreed that that's a reasonable
> approach.

Thanks, thats pretty much what I had in mind. Though I would expect
some minor breakage, at least for people who expect nonsetuid loadkeys
to work. But then again, that is the whole point.

> I'll stick the below in -mm, see what breaks.
> 
> --- devel/drivers/char/vt_ioctl.c~setkeys-needs-root	2005-10-17 23:50:37.000000000 -0700
> +++ devel-akpm/drivers/char/vt_ioctl.c	2005-10-17 23:51:43.000000000 -0700
> @@ -192,6 +192,9 @@ do_kdgkb_ioctl(int cmd, struct kbsentry 
>  	int i, j, k;
>  	int ret;
>  
> +	if (!capable(CAP_SYS_TTY_CONFIG))
> +		return -EPERM;
> +
>  	kbs = kmalloc(sizeof(*kbs), GFP_KERNEL);
>  	if (!kbs) {
>  		ret = -ENOMEM;
> _

-- 
Horms