Re: [PATCH 01/13] devpts: Teach /dev/ptmx to find the associated devpts via path lookup

From	ebiederm@xmission.com (Eric W. Biederman)
Newsgroups	linux.kernel
Subject	Re: [PATCH 01/13] devpts: Teach /dev/ptmx to find the associated devpts via path lookup
Date	2016-04-09 01:20 +0200
Message-ID	<rlNR0-3Mp-9@gated-at.bofh.it> (permalink)
References	(3 earlier) <rlJX4-7e-27@gated-at.bofh.it> <rlJX5-7e-49@gated-at.bofh.it> <rlLvR-133-11@gated-at.bofh.it> <rlMrT-1R1-3@gated-at.bofh.it> <rlMBC-21s-37@gated-at.bofh.it>
Organization	linux.* mail to news gateway

Show all headers | View raw

Linus Torvalds <torvalds@linux-foundation.org> writes:

> But more fundamentally I still don't actually understand why you even
> really care.

At this point I care because there is a failure of communication.
Until this email no one has ever said:  "Ok that actually could happen
but we don't actually care."

Right now I am a bit paranoid because I have seen a few too many cases
where some little detail was glossed over and someone clever turned it
into a great big CVE they could drive a truck through.  So I am once
bitten twice shy and all of that.

> We get the wrong pts case *today*. We'd get a different wrong pts
> namespace when somebody tries to do odd things. Why would we care? It
> would be a _better_ guess.
>
> I don't see the security issue. If you do tricks to get pty's in
> another group, what's the problem? You have to do it consciously, and
> I don't see what the downside is. You get what you ask for, and I
> don't see a new attack surface.
>
> The whole "somebody used chmod on /dev/pts/" argument sounds bogus.
> That's an insane thing to do. If you want a private namespace, you
> make *all* of /dev private, you don't go "oh, I'll just make the pts
> subdirectory private".

Oh I pretty much agree it is an insane thing to do.  At the same time I
know that people can make a lot of little sane decisions that can lead
to an insane situation, so just because it is insane I can't rule
it out automatically.

The actual sane thing to do, and what I think most of userspace does
at this point is to create it's own mount namespace so nothing is
visible to outsiders.

> In other words, your whole scenario sounds totally made up to begin
> with. And even if it happens, I don't see what would be so disastrous
> about it.

In general I agree.  The scenario is made up.  I would be surprised if
it happens.

> I mean, right now, /dev/ptmx is world read-write in the root container
> and everybody gets access to the same underlying set of ptys. And
> that's not some horrible security issue. It's how things are
> *supposed* to work.

I agree.

> So I really don't see the argument. You guys are just making shit up.

I don't see why we have the linux extension of supporting anything
except mode 0666 on /dev/ptmx or /dev/pts/ptmx.  This is really about
not breaking that linux extension by overlooking some little detail.

On the attack analysis front the worst thing I can see happening is a
denial of service attack.  I see two possible denial of service attacks.
One possible attack creates a pty and prevents devpts from being
unmounted.  Another possible attack creates all possible ptys on a
devpts instance, and prevents legitimate tty creations from happening.

At the end of the day as you say it would be a pretty crazy person who
isolated a mount of devpts with just the permissions of /dev/pts/ptmx.
So if we don't want to care knowing those stupid attacks above are
possible I am happy not to care.  They don't look all that serious to
me.

Eric

Thread

[PATCH 00/13] devpts: New instances for every mount ebiederm@xmission.com (Eric W. Biederman) - 2016-04-05 02:20 +0200
  [PATCH 04/13] devpts: Stop rolling devpts_remount by hand in devpts_mount "Eric W. Biederman" <ebiederm@xmission.com> - 2016-04-05 03:50 +0200
  [PATCH 05/13] devpts: Fail early (if appropriate) on overmount "Eric W. Biederman" <ebiederm@xmission.com> - 2016-04-05 03:50 +0200
  [PATCH 08/13] devpts: Make devpts_kill_sb safe if fsi is NULL "Eric W. Biederman" <ebiederm@xmission.com> - 2016-04-05 03:50 +0200
  [PATCH 03/13] devpts: Cleanup newinstance parsing "Eric W. Biederman" <ebiederm@xmission.com> - 2016-04-05 03:50 +0200
  [PATCH 06/13] devpts: Use the same default mode for both /dev/ptmx and dev/pts/ptmx "Eric W. Biederman" <ebiederm@xmission.com> - 2016-04-05 03:50 +0200
  [PATCH 01/13] devpts: Teach /dev/ptmx to find the associated devpts via path lookup "Eric W. Biederman" <ebiederm@xmission.com> - 2016-04-05 03:50 +0200
    [PATCH 09/13] devpts: Move the creation of /dev/pts/ptmx into fill_super "Eric W. Biederman" <ebiederm@xmission.com> - 2016-04-05 03:50 +0200
    [PATCH 02/13] devpts: More obvious check for the system devpts in pty allocation "Eric W. Biederman" <ebiederm@xmission.com> - 2016-04-05 03:50 +0200
    [PATCH 13/13] devpts: Kill the DEVPTS_MULTIPLE_INSTANCE config option "Eric W. Biederman" <ebiederm@xmission.com> - 2016-04-05 03:50 +0200
    [PATCH 07/13] devpts: Move parse_mount_options into fill_super "Eric W. Biederman" <ebiederm@xmission.com> - 2016-04-05 03:50 +0200
    [PATCH 12/13] devpts: Always return a distinct instance when mounting "Eric W. Biederman" <ebiederm@xmission.com> - 2016-04-05 04:00 +0200
    [PATCH 11/13] vfs: Implement mount_super_once "Eric W. Biederman" <ebiederm@xmission.com> - 2016-04-05 04:00 +0200
    [PATCH 10/13] devpts: Simplify devpts_mount by using mount_nodev "Eric W. Biederman" <ebiederm@xmission.com> - 2016-04-05 04:00 +0200
    Re: [PATCH 01/13] devpts: Teach /dev/ptmx to find the associated  devpts via path lookup Al Viro <viro@ZenIV.linux.org.uk> - 2016-04-05 05:00 +0200
      Re: [PATCH 01/13] devpts: Teach /dev/ptmx to find the associated  devpts via path lookup Al Viro <viro@ZenIV.linux.org.uk> - 2016-04-05 05:10 +0200
        Re: [PATCH 01/13] devpts: Teach /dev/ptmx to find the associated devpts via path lookup ebiederm@xmission.com (Eric W. Biederman) - 2016-04-08 21:10 +0200
    Re: [PATCH 01/13] devpts: Teach /dev/ptmx to find the associated  devpts via path lookup Linus Torvalds <torvalds@linux-foundation.org> - 2016-04-07 18:10 +0200
      Re: [PATCH 01/13] devpts: Teach /dev/ptmx to find the associated devpts via path lookup ebiederm@xmission.com (Eric W. Biederman) - 2016-04-08 21:10 +0200
        Re: [PATCH 01/13] devpts: Teach /dev/ptmx to find the associated  devpts via path lookup Linus Torvalds <torvalds@linux-foundation.org> - 2016-04-08 21:10 +0200
          Re: [PATCH 01/13] devpts: Teach /dev/ptmx to find the associated devpts via path lookup ebiederm@xmission.com (Eric W. Biederman) - 2016-04-08 22:20 +0200
          Re: [PATCH 01/13] devpts: Teach /dev/ptmx to find the associated  devpts via path lookup Andy Lutomirski <luto@amacapital.net> - 2016-04-08 22:50 +0200
            Re: [PATCH 01/13] devpts: Teach /dev/ptmx to find the associated devpts via path lookup ebiederm@xmission.com (Eric W. Biederman) - 2016-04-08 23:50 +0200
              Re: [PATCH 01/13] devpts: Teach /dev/ptmx to find the associated  devpts via path lookup Andy Lutomirski <luto@amacapital.net> - 2016-04-09 00:00 +0200
              Re: [PATCH 01/13] devpts: Teach /dev/ptmx to find the associated  devpts via path lookup Linus Torvalds <torvalds@linux-foundation.org> - 2016-04-09 00:00 +0200
                Re: [PATCH 01/13] devpts: Teach /dev/ptmx to find the associated devpts via path lookup ebiederm@xmission.com (Eric W. Biederman) - 2016-04-09 01:20 +0200
        Re: [PATCH 01/13] devpts: Teach /dev/ptmx to find the associated  devpts via path lookup One Thousand Gnomes <gnomes@lxorguk.ukuu.org.uk> - 2016-04-09 15:20 +0200
          Re: [PATCH 01/13] devpts: Teach /dev/ptmx to find the associated devpts via path lookup "H. Peter Anvin" <hpa@zytor.com> - 2016-04-09 16:20 +0200
            Re: [PATCH 01/13] devpts: Teach /dev/ptmx to find the associated devpts via path lookup ebiederm@xmission.com (Eric W. Biederman) - 2016-04-09 17:00 +0200
              Re: [PATCH 01/13] devpts: Teach /dev/ptmx to find the associated devpts via path lookup "H. Peter Anvin" <hpa@zytor.com> - 2016-04-10 00:50 +0200
                Re: [PATCH 01/13] devpts: Teach /dev/ptmx to find the associated  devpts via path lookup Linus Torvalds <torvalds@linux-foundation.org> - 2016-04-10 02:10 +0200
                Re: [PATCH 01/13] devpts: Teach /dev/ptmx to find the associated devpts via path lookup "H. Peter Anvin" <hpa@zytor.com> - 2016-04-10 02:20 +0200
                Re: [PATCH 01/13] devpts: Teach /dev/ptmx to find the associated  devpts via path lookup Linus Torvalds <torvalds@linux-foundation.org> - 2016-04-10 02:20 +0200
                Re: [PATCH 01/13] devpts: Teach /dev/ptmx to find the associated  devpts via path lookup Andy Lutomirski <luto@amacapital.net> - 2016-04-10 02:50 +0200
                Re: [PATCH 01/13] devpts: Teach /dev/ptmx to find the associated devpts via path lookup "H. Peter Anvin" <hpa@zytor.com> - 2016-04-11 17:10 +0200
                Re: [PATCH 01/13] devpts: Teach /dev/ptmx to find the associated  devpts via path lookup Al Viro <viro@ZenIV.linux.org.uk> - 2016-04-12 03:40 +0200
                Re: [PATCH 01/13] devpts: Teach /dev/ptmx to find the associated  devpts via path lookup Andy Lutomirski <luto@amacapital.net> - 2016-04-11 22:20 +0200
                Re: [PATCH 01/13] devpts: Teach /dev/ptmx to find the associated devpts via path lookup "H. Peter Anvin" <hpa@zytor.com> - 2016-04-11 22:30 +0200
                Re: [PATCH 01/13] devpts: Teach /dev/ptmx to find the associated devpts via path lookup ebiederm@xmission.com (Eric W. Biederman) - 2016-04-12 01:50 +0200
                Re: [PATCH 01/13] devpts: Teach /dev/ptmx to find the associated  devpts via path lookup Linus Torvalds <torvalds@linux-foundation.org> - 2016-04-12 02:10 +0200
                Re: [PATCH 01/13] devpts: Teach /dev/ptmx to find the associated devpts via path lookup ebiederm@xmission.com (Eric W. Biederman) - 2016-04-12 02:30 +0200
                Re: [PATCH 01/13] devpts: Teach /dev/ptmx to find the associated  devpts via path lookup Linus Torvalds <torvalds@linux-foundation.org> - 2016-04-12 03:20 +0200
                Re: [PATCH 01/13] devpts: Teach /dev/ptmx to find the associated devpts via path lookup "H. Peter Anvin" <hpa@zytor.com> - 2016-04-12 03:20 +0200
                Re: [PATCH 01/13] devpts: Teach /dev/ptmx to find the associated devpts via path lookup ebiederm@xmission.com (Eric W. Biederman) - 2016-04-12 03:40 +0200
                Re: [PATCH 01/13] devpts: Teach /dev/ptmx to find the associated  devpts via path lookup Al Viro <viro@ZenIV.linux.org.uk> - 2016-04-12 03:50 +0200
                Re: [PATCH 01/13] devpts: Teach /dev/ptmx to find the associated  devpts via path lookup Al Viro <viro@ZenIV.linux.org.uk> - 2016-04-12 03:40 +0200
                Re: [PATCH 01/13] devpts: Teach /dev/ptmx to find the associated devpts via path lookup ebiederm@xmission.com (Eric W. Biederman) - 2016-04-12 04:30 +0200
                Re: [PATCH 01/13] devpts: Teach /dev/ptmx to find the associated devpts via path lookup ebiederm@xmission.com (Eric W. Biederman) - 2016-04-11 22:30 +0200
                Re: [PATCH 01/13] devpts: Teach /dev/ptmx to find the associated  devpts via path lookup Andy Lutomirski <luto@amacapital.net> - 2016-04-12 19:50 +0200
                Re: [PATCH 01/13] devpts: Teach /dev/ptmx to find the associated  devpts via path lookup Linus Torvalds <torvalds@linux-foundation.org> - 2016-04-12 20:20 +0200
                Re: [PATCH 01/13] devpts: Teach /dev/ptmx to find the associated  devpts via path lookup "H. Peter Anvin" <hpa@zytor.com> - 2016-04-12 21:20 +0200
                [PATCH 01/16] devpts: Attempting to get it right ebiederm@xmission.com (Eric W. Biederman) - 2016-04-15 17:50 +0200
                [PATCH 08/16] devpts: Stop rolling devpts_remount by hand in devpts_mount "Eric W. Biederman" <ebiederm@xmission.com> - 2016-04-15 17:50 +0200
                [PATCH 05/16] vfs: Allow unlink, and rename on expirable file mounts "Eric W. Biederman" <ebiederm@xmission.com> - 2016-04-15 17:50 +0200
                [PATCH 04/16] devpts: Teach /dev/ptmx to automount the appropriate devpts via path lookup "Eric W. Biederman" <ebiederm@xmission.com> - 2016-04-15 17:50 +0200
                [PATCH 09/16] devpts: Fail early (if appropriate) on overmount "Eric W. Biederman" <ebiederm@xmission.com> - 2016-04-15 17:50 +0200
                [PATCH 10/16] devpts: Move parse_mount_options into fill_super "Eric W. Biederman" <ebiederm@xmission.com> - 2016-04-15 17:50 +0200
                [PATCH 06/16] devpts: More obvious check for the system devpts in pty allocation "Eric W. Biederman" <ebiederm@xmission.com> - 2016-04-15 17:50 +0200
                [PATCH 01/16] devpts: Use the same default mode for both /dev/ptmx and dev/pts/ptmx "Eric W. Biederman" <ebiederm@xmission.com> - 2016-04-15 17:50 +0200
                [PATCH 12/16] devpts: Move the creation of /dev/pts/ptmx into fill_super "Eric W. Biederman" <ebiederm@xmission.com> - 2016-04-15 18:00 +0200
                [PATCH 11/16] devpts: Make devpts_kill_sb safe if fsi is NULL "Eric W. Biederman" <ebiederm@xmission.com> - 2016-04-15 18:00 +0200
                [PATCH 16/16] devpts: Kill the DEVPTS_MULTIPLE_INSTANCE config option "Eric W. Biederman" <ebiederm@xmission.com> - 2016-04-15 18:00 +0200
                [PATCH 15/16] devpts: Always return a distinct instance when mounting "Eric W. Biederman" <ebiederm@xmission.com> - 2016-04-15 18:00 +0200
                [PATCH 13/16] devpts: Simplify devpts_mount by using mount_nodev "Eric W. Biederman" <ebiederm@xmission.com> - 2016-04-15 18:00 +0200
                [PATCH 14/16] vfs: Implement mount_super_once "Eric W. Biederman" <ebiederm@xmission.com> - 2016-04-15 18:00 +0200
                Re: [PATCH 01/13] devpts: Teach /dev/ptmx to find the associated devpts via path lookup ebiederm@xmission.com (Eric W. Biederman) - 2016-04-12 02:10 +0200
                Re: [PATCH 01/13] devpts: Teach /dev/ptmx to find the associated  devpts via path lookup Linus Torvalds <torvalds@linux-foundation.org> - 2016-04-12 02:10 +0200
                Re: [PATCH 01/13] devpts: Teach /dev/ptmx to find the associated devpts via path lookup ebiederm@xmission.com (Eric W. Biederman) - 2016-04-12 02:40 +0200
                Re: [PATCH 01/13] devpts: Teach /dev/ptmx to find the associated  devpts via path lookup Linus Torvalds <torvalds@linux-foundation.org> - 2016-04-12 03:00 +0200
                Re: [PATCH 01/13] devpts: Teach /dev/ptmx to find the associated devpts via path lookup ebiederm@xmission.com (Eric W. Biederman) - 2016-04-11 22:20 +0200

csiph-web