Patchset to Restrict Unprivileged TIOCSTI TTY Command Injection

From	Matt Brown <matt@nmatt.com>
Newsgroups	linux.kernel
Subject	Patchset to Restrict Unprivileged TIOCSTI TTY Command Injection
Date	2017-04-17 08:10 +0200
Message-ID	<tx81j-5DY-7@gated-at.bofh.it> (permalink)
Organization	linux.* mail to news gateway

Show all headers | View raw

The following patchset reproduces GRKERNSEC_HARDEN_TTY functionality from the grsecurity project in-kernel. The purpose of this feature is to restrict unprivileged users from injecting commands into other processes in the same tty session by using the TIOCSTI ioctl.

It creates the kernel config SECURITY_TIOCSTI_RESTRICT and the sysctl kernel.tiocsti_restrict to control this feature. I modeled most of the code style and naming conventions off of SECURITY_DMESG_RESTRICT.

 drivers/tty/tty_io.c |  4 ++++
 include/linux/tty.h  |  2 ++
 kernel/sysctl.c      | 12 ++++++++++++
 security/Kconfig     | 12 ++++++++++++
 4 files changed, 30 insertions(+)

[PATCH 1/4] added SECURITY_TIOCSTI_RESTRICT kernel config
[PATCH 2/4] add tiocsti_restrict variable
[PATCH 3/4] restrict unprivileged TIOCSTI tty ioctl
[PATCH 4/4] added kernel.tiocsti_restrict sysctl

Back to linux.kernel | Previous | Next — Next in thread | Find similar | Unroll thread

Thread

Patchset to Restrict Unprivileged TIOCSTI TTY Command Injection Matt Brown <matt@nmatt.com> - 2017-04-17 08:10 +0200
  [PATCH 3/4] restrict unprivileged TIOCSTI tty ioctl Matt Brown <matt@nmatt.com> - 2017-04-17 08:10 +0200
    Re: [PATCH 3/4] restrict unprivileged TIOCSTI tty ioctl Greg KH <gregkh@linuxfoundation.org> - 2017-04-17 09:00 +0200
      Re: [kernel-hardening] Re: [PATCH 3/4] restrict unprivileged TIOCSTI  tty ioctl Jann Horn <jannh@google.com> - 2017-04-17 16:20 +0200
        Re: [kernel-hardening] Re: [PATCH 3/4] restrict unprivileged TIOCSTI  tty ioctl Matt Brown <matt@nmatt.com> - 2017-04-17 18:30 +0200

csiph-web