Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]
Groups > linux.debian.kernel > #86365 > unrolled thread
| Started by | Chris Hofstaedtler <zeha@debian.org> |
|---|---|
| First post | 2025-03-06 23:00 +0100 |
| Last post | 2025-03-28 05:40 +0100 |
| Articles | 4 — 3 participants |
Back to article view | Back to linux.debian.kernel
Bug#1099697: initramfs-tools: please change default /dev/pts mode to 0600 Chris Hofstaedtler <zeha@debian.org> - 2025-03-06 23:00 +0100
Bug#1099697: initramfs-tools: please change default /dev/pts mode to 0600 Chris Hofstaedtler <zeha@debian.org> - 2025-03-07 08:10 +0100
Bug#1099697: initramfs-tools: please change default /dev/pts mode to 0600 cacin@allfreemail.net - 2025-03-07 08:40 +0100
Bug#1099697: marked as done (initramfs-tools: please change default /dev/pts mode to 0600) "Debian Bug Tracking System" <owner@bugs.debian.org> - 2025-03-28 05:40 +0100
| From | Chris Hofstaedtler <zeha@debian.org> |
|---|---|
| Date | 2025-03-06 23:00 +0100 |
| Subject | Bug#1099697: initramfs-tools: please change default /dev/pts mode to 0600 |
| Message-ID | <Knrq1-48Px-1@gated-at.bofh.it> |
[Multipart message — attachments visible in raw view] — view raw
Package: initramfs-tools Version: 0.145 Severity: important Hi, in the past there were security concerns (and security issues raised) around other users writing to each others terminals. Some of this was workarounded in util-linux, cf. CVE-2024-28085. A fuller fix is to disallow writing unrelated users to each other's terminals by default. I understand it might be a bit late for this bug report to reach you, but I /thought/ systemd mounts /dev/pts as part of its boot process. systemd has (after taking some time) applied their part of the fix, but it turns out systemd does -not- mount or remount /dev/pts in Debian's default setup. Instead the mount flags from initramfs-tools are used. Theoretically we have TTYPERM in /etc/login.defs, but it appears almost nothing cares about this value. Please find a patch attached following the change from 0620 to 0600 for initramfs-tools. Please apply this for trixie. Again sorry for not sending this earlier, I didn't realise initramfs-tools was involved. Thanks, Chris
[toc] | [next] | [standalone]
| From | Chris Hofstaedtler <zeha@debian.org> |
|---|---|
| Date | 2025-03-07 08:10 +0100 |
| Message-ID | <KnA0h-4eZI-1@gated-at.bofh.it> |
| In reply to | #86365 |
On Thu, Mar 06, 2025 at 10:46:17PM +0100, Chris Hofstaedtler wrote: > in the past there were security concerns (and security issues > raised) around other users writing to each others terminals. Some of > this was workarounded in util-linux, cf. CVE-2024-28085. > > A fuller fix is to disallow writing unrelated users to each other's > terminals by default. [..] > Please find a patch attached > following the change from 0620 to 0600 for initramfs-tools. [..] Salsa merge request: https://salsa.debian.org/kernel-team/initramfs-tools/-/merge_requests/161 Best, Chris
[toc] | [prev] | [next] | [standalone]
| From | cacin@allfreemail.net |
|---|---|
| Date | 2025-03-07 08:40 +0100 |
| Message-ID | <KnAtj-4faQ-1@gated-at.bofh.it> |
| In reply to | #86365 |
Package: initramfs-tools Version: 0.146 Followup-For: Bug #1099697 When this bug is fixed close #1095991 [1] as well. It was filed earlier, but with a lower severity and against a different package name, so I can't merge the bugs. [1] https://bugs.debian.org/1095991
[toc] | [prev] | [next] | [standalone]
| From | "Debian Bug Tracking System" <owner@bugs.debian.org> |
|---|---|
| Date | 2025-03-28 05:40 +0100 |
| Subject | Bug#1099697: marked as done (initramfs-tools: please change default /dev/pts mode to 0600) |
| Message-ID | <Kv9FD-9f3y-7@gated-at.bofh.it> |
| In reply to | #86365 |
[Multipart message — attachments visible in raw view] — view raw
Your message dated Fri, 28 Mar 2025 01:48:56 +0000 with message-id <E1txyq8-00FfXu-NO@fasolo.debian.org> and subject line Bug#1095991: fixed in initramfs-tools 0.147 has caused the Debian Bug report #1095991, regarding initramfs-tools: please change default /dev/pts mode to 0600 to be marked as done. This means that you claim that the problem has been dealt with. If this is not the case it is now your responsibility to reopen the Bug report if necessary, and/or fix the problem forthwith. (NB: If you are a system administrator and have no idea what this message is talking about, this may indicate a serious mail system misconfiguration somewhere. Please contact owner@bugs.debian.org immediately.) -- 1095991: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1095991 Debian Bug Tracking System Contact owner@bugs.debian.org with problems
[toc] | [prev] | [standalone]
Back to top | Article view | linux.debian.kernel
csiph-web