Hello Michael,
it seems as the kernel folks backported this into 4.14.x by now:
[root@maverick ~]# uname -a Linux maverick 4.14.212-ipfire #1 SMP Wed Dec 16 12:01:25 GMT 2020 x86_64 Intel(R) Celeron(R) CPU N3150 @ 1.60GHz GenuineIntel GNU/Linux [root@maverick ~]# sysctl dev.tty.ldisc_autoload dev.tty.ldisc_autoload = 1
Therefore, I would like to see this patch being merged - that is, if it is still applicable. :-)
Thanks, and best regards, Peter Müller
Hello Michael,
grmpf, overlooked some patched distribution kernel again. :-/
Sorry for the noise - I will keep the patch queued and wait for kernel 5.9 ...
Thanks, and best regards, Peter Müller
This does not exist before kernel 5.1.
-Michael
On 5 Oct 2020, at 20:45, Peter Müller peter.mueller@ipfire.org wrote:
Malicious/vulnerable TTY line disciplines have been subject of some kernel exploits such as CVE-2017-2636, and since - to put it in Greg Kroah-Hatrman's words - we do not "trust the userspace to do the right thing", this reduces local kernel attack surface.
Further, there is no legitimate reason why an unprivileged user should load kernel modules during runtime, anyway.
See also:
Cc: Arne Fitzenreiter arne.fitzenreiter@ipfire.org Cc: Michael Tremer michael.tremer@ipfire.org Signed-off-by: Peter Müller peter.mueller@ipfire.org
config/etc/sysctl.conf | 4 ++++ 1 file changed, 4 insertions(+)
diff --git a/config/etc/sysctl.conf b/config/etc/sysctl.conf index d48c7734e..b5ede15ed 100644 --- a/config/etc/sysctl.conf +++ b/config/etc/sysctl.conf @@ -39,6 +39,10 @@ net.bridge.bridge-nf-call-ip6tables = 0 net.bridge.bridge-nf-call-iptables = 0 net.bridge.bridge-nf-call-arptables = 0
+# Restrict loading TTY line disciplines to CAP_SYS_MODULE to prevent unprivileged attackers +# from loading vulnerable line disciplines with the TIOCSETD ioctl. +dev.tty.ldisc_autoload = 0
# Try to keep kernel address exposures out of various /proc files (kallsyms, modules, etc). kernel.kptr_restrict = 2
-- 2.26.2