Re: [PATCH] Restrict access to TIOCLINUX

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



On Sun, 2 Apr 2023 16:55:01 +0200
Greg KH <gregkh@xxxxxxxxxxxxxxxxxxx> wrote:

> You just now broke any normal user programs that required this (or the
> other ioctls), and so you are going to have to force them to be run
> with CAP_SYS_ADMIN permissions? 

Are you aware of such normal user programs?
It was my impression that this is a relatively obscure feature and gpm
is pretty much the only tool using it.

> And you didn't change anything for programs like gpm that already had
> root permission (and shouldn't that permission be dropped anyway?)

Well, you could restrict all that to a specific capability. However, it
is my understanding that the existing capability system is limited in
the number of capabilities and new ones should only be introduced in
rare cases. It does not seem a feature probably few people use anyway
deserves a new capability.

Do you have other proposals how to fix this issue? One could introduce
an option like for TIOCSTI that allows disabling selection features by
default.


-- 
Hanno Böck
https://hboeck.de/




[Index of Archives]     [Linux Samsung SoC]     [Linux Rockchip SoC]     [Linux Actions SoC]     [Linux for Synopsys ARC Processors]     [Linux NFS]     [Linux NILFS]     [Linux USB Devel]     [Video for Linux]     [Linux Audio Users]     [Yosemite News]     [Linux Kernel]     [Linux SCSI]


  Powered by Linux