Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.bugs.dist > #1236481 > unrolled thread

Bug#1099697: initramfs-tools: please change default /dev/pts mode to 0600

Back to article view | Back to linux.debian.bugs.dist

Contents

  Bug#1099697: initramfs-tools: please change default /dev/pts mode to 0600 Chris Hofstaedtler <zeha@debian.org> - 2025-03-06 23:00 +0100
    Bug#1099697: initramfs-tools: please change default /dev/pts mode to 0600 Chris Hofstaedtler <zeha@debian.org> - 2025-03-07 08:10 +0100
    Bug#1099697: initramfs-tools: please change default /dev/pts mode to 0600 cacin@allfreemail.net - 2025-03-07 08:40 +0100

#1236481 — Bug#1099697: initramfs-tools: please change default /dev/pts mode to 0600

[Multipart message — attachments visible in raw view] — view raw

Package: initramfs-tools
Version: 0.145
Severity: important

Hi,

in the past there were security concerns (and security issues 
raised) around other users writing to each others terminals. Some of 
this was workarounded in util-linux, cf. CVE-2024-28085.

A fuller fix is to disallow writing unrelated users to each other's 
terminals by default.

I understand it might be a bit late for this bug report to reach 
you, but I /thought/ systemd mounts /dev/pts as part of its boot 
process. systemd has (after taking some time) applied their part of 
the fix, but it turns out systemd does -not- mount or remount 
/dev/pts in Debian's default setup.  Instead the mount flags from
initramfs-tools are used.

Theoretically we have TTYPERM in /etc/login.defs, but it appears 
almost nothing cares about this value. Please find a patch attached
following the change from 0620 to 0600 for initramfs-tools.

Please apply this for trixie.

Again sorry for not sending this earlier, I didn't realise 
initramfs-tools was involved.

Thanks,
Chris

[toc] | [next] | [standalone]

#1236515

On Thu, Mar 06, 2025 at 10:46:17PM +0100, Chris Hofstaedtler wrote:
> in the past there were security concerns (and security issues 
> raised) around other users writing to each others terminals. Some of 
> this was workarounded in util-linux, cf. CVE-2024-28085.
> 
> A fuller fix is to disallow writing unrelated users to each other's 
> terminals by default.
[..]
> Please find a patch attached
> following the change from 0620 to 0600 for initramfs-tools.
[..]

Salsa merge request:
https://salsa.debian.org/kernel-team/initramfs-tools/-/merge_requests/161

Best,
Chris

[toc] | [prev] | [next] | [standalone]

#1236519

Package: initramfs-tools
Version: 0.146
Followup-For: Bug #1099697

When this bug is fixed close #1095991 [1] as well. It was filed earlier,
but with a lower severity and against a different package name, so I
can't merge the bugs.

[1] https://bugs.debian.org/1095991

[toc] | [prev] | [standalone]

Back to top | Article view | linux.debian.bugs.dist

csiph-web