Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]
Groups > linux.kernel > #1624552 > unrolled thread
| Started by | Matt Brown <matt@nmatt.com> |
|---|---|
| First post | 2017-04-17 08:10 +0200 |
| Last post | 2017-04-18 17:50 +0200 |
| Articles | 5 — 4 participants |
Back to article view | Back to linux.kernel
This discussion starts older than the indexed window; earlier articles aren't shown. The article labeled Started by
below is the oldest one visible, not the original post.
[PATCH 1/4] added SECURITY_TIOCSTI_RESTRICT kernel config Matt Brown <matt@nmatt.com> - 2017-04-17 08:10 +0200
Re: [PATCH 1/4] added SECURITY_TIOCSTI_RESTRICT kernel config Greg KH <gregkh@linuxfoundation.org> - 2017-04-17 09:00 +0200
Re: [PATCH 1/4] added SECURITY_TIOCSTI_RESTRICT kernel config Matt Brown <matt@nmatt.com> - 2017-04-18 06:40 +0200
Re: [PATCH 1/4] added SECURITY_TIOCSTI_RESTRICT kernel config Alan Cox <gnomes@lxorguk.ukuu.org.uk> - 2017-04-18 16:30 +0200
Re: [kernel-hardening] Re: [PATCH 1/4] added SECURITY_TIOCSTI_RESTRICT kernel config Kees Cook <keescook@chromium.org> - 2017-04-18 17:50 +0200
| From | Matt Brown <matt@nmatt.com> |
|---|---|
| Date | 2017-04-17 08:10 +0200 |
| Subject | [PATCH 1/4] added SECURITY_TIOCSTI_RESTRICT kernel config |
| Message-ID | <tx81k-5DY-31@gated-at.bofh.it> |
adding the kernel config SECURITY_TIOCSTI_RESTRICT in order to allow the user to restrict unprivileged command injection using TIOCSTI tty ioctls Signed-off-by: Matt Brown <matt@nmatt.com> --- security/Kconfig | 12 ++++++++++++ 1 file changed, 12 insertions(+) diff --git a/security/Kconfig b/security/Kconfig index 3ff1bf9..d757bcb 100644 --- a/security/Kconfig +++ b/security/Kconfig @@ -18,6 +18,18 @@ config SECURITY_DMESG_RESTRICT If you are unsure how to answer this question, answer N. +config SECURITY_TIOCSTI_RESTRICT + bool "Restrict unprivileged use of tiocsti command injection" + default n + help + This enforces restrictions on unprivileged users injecting commands + into other processes in the same tty session using the TIOCSTI ioctl + + If this option is not selected, no restrictions will be enforced + unless the tiocsti_restrict sysctl is explicitly set to (1). + + If you are unsure how to answer this question, answer N. + config SECURITY bool "Enable different security models" depends on SYSFS -- 2.10.2
[toc] | [next] | [standalone]
| From | Greg KH <gregkh@linuxfoundation.org> |
|---|---|
| Date | 2017-04-17 09:00 +0200 |
| Message-ID | <tx8NI-5UK-5@gated-at.bofh.it> |
| In reply to | #1624552 |
On Mon, Apr 17, 2017 at 02:07:03AM -0400, Matt Brown wrote: > adding the kernel config SECURITY_TIOCSTI_RESTRICT in order to allow > the user to restrict unprivileged command injection using TIOCSTI > tty ioctls "unpriviledged command injection"? That sounds a bit "odd", don't you think? > > Signed-off-by: Matt Brown <matt@nmatt.com> > --- > security/Kconfig | 12 ++++++++++++ > 1 file changed, 12 insertions(+) > > diff --git a/security/Kconfig b/security/Kconfig > index 3ff1bf9..d757bcb 100644 > --- a/security/Kconfig > +++ b/security/Kconfig > @@ -18,6 +18,18 @@ config SECURITY_DMESG_RESTRICT > > If you are unsure how to answer this question, answer N. > > +config SECURITY_TIOCSTI_RESTRICT > + bool "Restrict unprivileged use of tiocsti command injection" > + default n > + help > + This enforces restrictions on unprivileged users injecting commands > + into other processes in the same tty session using the TIOCSTI ioctl Tabs and spaces? Since tty sessions are usually separated by different users, how would they have the same one and yet need something like this? Also, why not put this in the tty config section? And finally, this patch on its own doesn't do anything :( thanks, greg k-h
[toc] | [prev] | [next] | [standalone]
| From | Matt Brown <matt@nmatt.com> |
|---|---|
| Date | 2017-04-18 06:40 +0200 |
| Message-ID | <txt5M-1FB-9@gated-at.bofh.it> |
| In reply to | #1624574 |
On 04/17/2017 02:50 AM, Greg KH wrote: > On Mon, Apr 17, 2017 at 02:07:03AM -0400, Matt Brown wrote: >> adding the kernel config SECURITY_TIOCSTI_RESTRICT in order to allow >> the user to restrict unprivileged command injection using TIOCSTI >> tty ioctls > > "unpriviledged command injection"? That sounds a bit "odd", don't you > think? > >> >> Signed-off-by: Matt Brown <matt@nmatt.com> >> --- >> security/Kconfig | 12 ++++++++++++ >> 1 file changed, 12 insertions(+) >> >> diff --git a/security/Kconfig b/security/Kconfig >> index 3ff1bf9..d757bcb 100644 >> --- a/security/Kconfig >> +++ b/security/Kconfig >> @@ -18,6 +18,18 @@ config SECURITY_DMESG_RESTRICT >> >> If you are unsure how to answer this question, answer N. >> >> +config SECURITY_TIOCSTI_RESTRICT >> + bool "Restrict unprivileged use of tiocsti command injection" >> + default n >> + help >> + This enforces restrictions on unprivileged users injecting commands >> + into other processes in the same tty session using the TIOCSTI ioctl > > Tabs and spaces? > Sorry about that. Used the wrong vimrc for part of the Kconfig. Will fix in updated patch. > Since tty sessions are usually separated by different users, how would > they have the same one and yet need something like this? > > Also, why not put this in the tty config section? > > And finally, this patch on its own doesn't do anything :( > I will take your input, update my code, and resubmit as a single patch. > thanks, > > greg k-h >
[toc] | [prev] | [next] | [standalone]
| From | Alan Cox <gnomes@lxorguk.ukuu.org.uk> |
|---|---|
| Date | 2017-04-18 16:30 +0200 |
| Message-ID | <txCiK-7dQ-11@gated-at.bofh.it> |
| In reply to | #1624574 |
> Since tty sessions are usually separated by different users, how would > they have the same one and yet need something like this? > > Also, why not put this in the tty config section? The normal attack use case people argue about is a rogue process on the users machine sitting there waiting until the user has logged in to a remote machine and is idle and then doing stuff. Attackers of course don't bother doing that because it's easier to get the user to run a different ssh client instead. Alan
[toc] | [prev] | [next] | [standalone]
| From | Kees Cook <keescook@chromium.org> |
|---|---|
| Date | 2017-04-18 17:50 +0200 |
| Subject | Re: [kernel-hardening] Re: [PATCH 1/4] added SECURITY_TIOCSTI_RESTRICT kernel config |
| Message-ID | <txDya-7Sz-17@gated-at.bofh.it> |
| In reply to | #1625357 |
On Tue, Apr 18, 2017 at 6:40 AM, Alan Cox <gnomes@lxorguk.ukuu.org.uk> wrote: >> Since tty sessions are usually separated by different users, how would >> they have the same one and yet need something like this? >> >> Also, why not put this in the tty config section? > > The normal attack use case people argue about is a rogue process on the > users machine sitting there waiting until the user has logged in to a > remote machine and is idle and then doing stuff. It's still a threat, though, and adding this with default n to allow the more paranoid builders a chance to mitigate it seems reasonable to me. > Attackers of course don't bother doing that because it's easier to get > the user to run a different ssh client instead. Attackers will always take the easiest route, so we have to keep killing the low hanging fruit. -Kees -- Kees Cook Pixel Security
[toc] | [prev] | [standalone]
Back to top | Article view | linux.kernel
csiph-web