[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <2023040237-empty-etching-c988@gregkh>
Date: Sun, 2 Apr 2023 19:44:27 +0200
From: Greg KH <gregkh@...uxfoundation.org>
To: Hanno Böck <hanno@...eck.de>
Cc: kernel-hardening@...ts.openwall.com
Subject: Re: [PATCH] Restrict access to TIOCLINUX
On Sun, Apr 02, 2023 at 07:33:10PM +0200, Hanno Böck wrote:
> On Sun, 2 Apr 2023 19:23:44 +0200
> Greg KH <gregkh@...uxfoundation.org> wrote:
>
> > > Do you have other proposals how to fix this issue? One could
> > > introduce an option like for TIOCSTI that allows disabling
> > > selection features by default.
> >
> > What exact issue are you trying to fix here?
>
> The fact that the selection features of TIOCLINUX can be used for
> privilege escalation.
Only if you had root permissions already, and then go to try to run
something using su or sudo as someone with less permission, right?
And as you already had permissions before, it's not really an
excalation, or am I missing something?
> I already mentioned this in the original patch description, but I think
> the minitty.c example here illustrates this well:
> https://www.openwall.com/lists/oss-security/2023/03/14/3
>
> Compile it, do
> sudo -u [anynonprivilegeduser] ./minitty
>
> It'll execute shell code with root permission.
That doesn't work if you run it from a user without root permissions to
start with, right?
thanks,
greg k-h
Powered by blists - more mailing lists
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
