Bug#1099697: initramfs-tools: please change default /dev/pts mode to 0600

From	Chris Hofstaedtler <zeha@debian.org>
Newsgroups	linux.debian.bugs.dist, linux.debian.kernel
Subject	Bug#1099697: initramfs-tools: please change default /dev/pts mode to 0600
Date	2025-03-06 23:00 +0100
Message-ID	<Knrq1-48Px-1@gated-at.bofh.it> (permalink)
Organization	linux.* mail to news gateway

Cross-posted to 2 groups.

Show all headers | View raw

[Multipart message — attachments visible in raw view] - view raw

Package: initramfs-tools
Version: 0.145
Severity: important

Hi,

in the past there were security concerns (and security issues 
raised) around other users writing to each others terminals. Some of 
this was workarounded in util-linux, cf. CVE-2024-28085.

A fuller fix is to disallow writing unrelated users to each other's 
terminals by default.

I understand it might be a bit late for this bug report to reach 
you, but I /thought/ systemd mounts /dev/pts as part of its boot 
process. systemd has (after taking some time) applied their part of 
the fix, but it turns out systemd does -not- mount or remount 
/dev/pts in Debian's default setup.  Instead the mount flags from
initramfs-tools are used.

Theoretically we have TTYPERM in /etc/login.defs, but it appears 
almost nothing cares about this value. Please find a patch attached
following the change from 0620 to 0600 for initramfs-tools.

Please apply this for trixie.

Again sorry for not sending this earlier, I didn't realise 
initramfs-tools was involved.

Thanks,
Chris

Back to linux.debian.kernel | Previous | Next — Next in thread | Find similar | Unroll thread

Thread

Bug#1099697: initramfs-tools: please change default /dev/pts mode to 0600 Chris Hofstaedtler <zeha@debian.org> - 2025-03-06 23:00 +0100
  Bug#1099697: initramfs-tools: please change default /dev/pts mode to 0600 Chris Hofstaedtler <zeha@debian.org> - 2025-03-07 08:10 +0100
  Bug#1099697: initramfs-tools: please change default /dev/pts mode to 0600 cacin@allfreemail.net - 2025-03-07 08:40 +0100
  Bug#1099697: marked as done (initramfs-tools: please change  default /dev/pts mode to 0600) "Debian Bug Tracking System" <owner@bugs.debian.org> - 2025-03-28 05:40 +0100

csiph-web