Re: [kernel-hardening] Re: [PATCH v7 2/2] security: tty: make TIOCSTI ioctl require CAP_SYS_ADMIN

[Kees Cook]

On Tue, May 30, 2017 at 4:56 PM, Alan Cox <gnomes@xxxxxxxxxxxxxxxxxxx> wrote:
>> This is my point. Apps will continue to shoot themselves in the foot. Of course
>> the correct response to one of these vulns is to not pass ttys across a
>> security boundary. We have an opportunity here to reduce the impact of this bug
>> class at the kernel level.
>
> Not really.
>
> If you pass me your console for example I can mmap your framebuffer and
> spy on you all day. Or I could reprogram your fonts, your keyboard, your
> video mode, or use set and paste selection to write stuff. If you are
> using X and you can't get tty handles right you'll no doubt pass me a
> copy of your X file descriptor in which case I own your display, your
> keyboard and your mouse and I don't need to use TIOCSTI there either.
>
> There are so many different attacks based upon that screwup that the
> kernel cannot defend against them. You aren't exactly reducing the impact.

I still cannot wrap my head around why providing users with a
protection is a bad thing. Yes, the other tty games are bad, but this
fixes a specific and especially bad case that is easy to kill. It's
got a Kconfig and a sysctl. It's not on by default. This protects the
common case of privileged ttys that aren't attached to consoles, etc,
so while the framebuffer thing is an issue, it's not always an issue,
etc.

I'd like to hear Greg's thoughts on this series...

-Kees

-- 
Kees Cook
Pixel Security