From: Michael Tremer <michael.tremer@ipfire.org>
To: development@lists.ipfire.org
Subject: Re: [PATCH] linux: Forbid legacy TIOCSTI usage
Date: Tue, 16 Jan 2024 15:32:22 +0000 [thread overview]
Message-ID: <F88A7516-37C5-48CA-8E59-FB9DDFB25332@ipfire.org> (raw)
In-Reply-To: <17c81585-f4d4-4d48-81f5-0abfd55b6fb3@ipfire.org>
[-- Attachment #1: Type: text/plain, Size: 5256 bytes --]
Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org>
> On 14 Jan 2024, at 15:59, Peter Müller <peter.mueller(a)ipfire.org> wrote:
>
> To quote from the kernel documentation:
>
>> Historically the kernel has allowed TIOCSTI, which will push
>> characters into a controlling TTY. This continues to be used
>> as a malicious privilege escalation mechanism, and provides no
>> meaningful real-world utility any more. Its use is considered
>> a dangerous legacy operation, and can be disabled on most
>> systems.
>>
>> Say Y here only if you have confirmed that your system's
>> userspace depends on this functionality to continue operating
>> normally.
>>
>> Processes which run with CAP_SYS_ADMIN, such as BRLTTY, can
>> use TIOCSTI even when this is set to N.
>>
>> This functionality can be changed at runtime with the
>> dev.tty.legacy_tiocsti sysctl. This configuration option sets
>> the default value of the sysctl.
>
> This patch therefore proposes to no longer allow legacy TIOCSTI usage
> in IPFire, given its security implications and the apparent lack of
> legitimate usage.
>
> Signed-off-by: Peter Müller <peter.mueller(a)ipfire.org>
> ---
> config/kernel/kernel.config.aarch64-ipfire | 2 +-
> config/kernel/kernel.config.riscv64-ipfire | 2 +-
> config/kernel/kernel.config.x86_64-ipfire | 2 +-
> config/rootfiles/common/aarch64/linux | 1 -
> config/rootfiles/common/riscv64/linux | 1 -
> config/rootfiles/common/x86_64/linux | 1 -
> 6 files changed, 3 insertions(+), 6 deletions(-)
>
> diff --git a/config/kernel/kernel.config.aarch64-ipfire b/config/kernel/kernel.config.aarch64-ipfire
> index 4770ed828..9b8bfa559 100644
> --- a/config/kernel/kernel.config.aarch64-ipfire
> +++ b/config/kernel/kernel.config.aarch64-ipfire
> @@ -3575,7 +3575,7 @@ CONFIG_HW_CONSOLE=y
> CONFIG_VT_HW_CONSOLE_BINDING=y
> CONFIG_UNIX98_PTYS=y
> # CONFIG_LEGACY_PTYS is not set
> -CONFIG_LEGACY_TIOCSTI=y
> +# CONFIG_LEGACY_TIOCSTI is not set
> # CONFIG_LDISC_AUTOLOAD is not set
>
> #
> diff --git a/config/kernel/kernel.config.riscv64-ipfire b/config/kernel/kernel.config.riscv64-ipfire
> index fb4ec14d5..44d89c99e 100644
> --- a/config/kernel/kernel.config.riscv64-ipfire
> +++ b/config/kernel/kernel.config.riscv64-ipfire
> @@ -3249,7 +3249,7 @@ CONFIG_HW_CONSOLE=y
> CONFIG_VT_HW_CONSOLE_BINDING=y
> CONFIG_UNIX98_PTYS=y
> # CONFIG_LEGACY_PTYS is not set
> -CONFIG_LEGACY_TIOCSTI=y
> +# CONFIG_LEGACY_TIOCSTI is not set
> # CONFIG_LDISC_AUTOLOAD is not set
>
> #
> diff --git a/config/kernel/kernel.config.x86_64-ipfire b/config/kernel/kernel.config.x86_64-ipfire
> index 2a2748ea4..41d6f0635 100644
> --- a/config/kernel/kernel.config.x86_64-ipfire
> +++ b/config/kernel/kernel.config.x86_64-ipfire
> @@ -3497,7 +3497,7 @@ CONFIG_HW_CONSOLE=y
> CONFIG_VT_HW_CONSOLE_BINDING=y
> CONFIG_UNIX98_PTYS=y
> # CONFIG_LEGACY_PTYS is not set
> -CONFIG_LEGACY_TIOCSTI=y
> +# CONFIG_LEGACY_TIOCSTI is not set
> # CONFIG_LDISC_AUTOLOAD is not set
>
> #
> diff --git a/config/rootfiles/common/aarch64/linux b/config/rootfiles/common/aarch64/linux
> index 5d2d36a46..a32c3770e 100644
> --- a/config/rootfiles/common/aarch64/linux
> +++ b/config/rootfiles/common/aarch64/linux
> @@ -9185,7 +9185,6 @@ etc/modprobe.d/ipv6.conf
> #lib/modules/KVER-ipfire/build/include/config/LEDS_TRIGGER_TTY
> #lib/modules/KVER-ipfire/build/include/config/LED_TRIGGER_PHY
> #lib/modules/KVER-ipfire/build/include/config/LEGACY_DIRECT_IO
> -#lib/modules/KVER-ipfire/build/include/config/LEGACY_TIOCSTI
> #lib/modules/KVER-ipfire/build/include/config/LIB80211
> #lib/modules/KVER-ipfire/build/include/config/LIB80211_CRYPT_CCMP
> #lib/modules/KVER-ipfire/build/include/config/LIB80211_CRYPT_TKIP
> diff --git a/config/rootfiles/common/riscv64/linux b/config/rootfiles/common/riscv64/linux
> index c2e0191af..5e1ac921c 100644
> --- a/config/rootfiles/common/riscv64/linux
> +++ b/config/rootfiles/common/riscv64/linux
> @@ -8345,7 +8345,6 @@ etc/modprobe.d/ipv6.conf
> #lib/modules/KVER-ipfire/build/include/config/LEDS_USER
> #lib/modules/KVER-ipfire/build/include/config/LED_TRIGGER_PHY
> #lib/modules/KVER-ipfire/build/include/config/LEGACY_DIRECT_IO
> -#lib/modules/KVER-ipfire/build/include/config/LEGACY_TIOCSTI
> #lib/modules/KVER-ipfire/build/include/config/LIB80211
> #lib/modules/KVER-ipfire/build/include/config/LIB80211_CRYPT_CCMP
> #lib/modules/KVER-ipfire/build/include/config/LIB80211_CRYPT_TKIP
> diff --git a/config/rootfiles/common/x86_64/linux b/config/rootfiles/common/x86_64/linux
> index a51f3487f..f3a8dea19 100644
> --- a/config/rootfiles/common/x86_64/linux
> +++ b/config/rootfiles/common/x86_64/linux
> @@ -8996,7 +8996,6 @@ etc/modprobe.d/ipv6.conf
> #lib/modules/KVER-ipfire/build/include/config/LEDS_USER
> #lib/modules/KVER-ipfire/build/include/config/LED_TRIGGER_PHY
> #lib/modules/KVER-ipfire/build/include/config/LEGACY_DIRECT_IO
> -#lib/modules/KVER-ipfire/build/include/config/LEGACY_TIOCSTI
> #lib/modules/KVER-ipfire/build/include/config/LEGACY_VSYSCALL_NONE
> #lib/modules/KVER-ipfire/build/include/config/LIB80211
> #lib/modules/KVER-ipfire/build/include/config/LIB80211_CRYPT_CCMP
> --
> 2.35.3
prev parent reply other threads:[~2024-01-16 15:32 UTC|newest]
Thread overview: 2+ messages / expand[flat|nested] mbox.gz Atom feed top
2024-01-14 16:00 Peter Müller
2024-01-16 15:32 ` Michael Tremer [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=F88A7516-37C5-48CA-8E59-FB9DDFB25332@ipfire.org \
--to=michael.tremer@ipfire.org \
--cc=development@lists.ipfire.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox