On Mon, Aug 28, 2023 at 08:43:39PM +0200, Mickaël Salaün wrote: > On Mon, Aug 28, 2023 at 06:41:17PM +0200, Günther Noack wrote: > > From: Hanno Böck <hanno@xxxxxxxxx> > > > > TIOCLINUX can be used for privilege escalation on virtual terminals when > > code is executed via tools like su/sudo and sandboxing tools. > > > > By abusing the selection features, a lower-privileged application can > > write content to the console, select and copy/paste that content and > > thereby executing code on the privileged account. See also the poc > > here: > > > > https://www.openwall.com/lists/oss-security/2023/03/14/3 > > > > Selection is usually used by tools like gpm that provide mouse features > > on the virtual console. gpm already runs as root (due to earlier > > changes that restrict access to a user on the current TTY), therefore > > it will still work with this change. > > > > With this change, the following TIOCLINUX subcommands require > > CAP_SYS_ADMIN: > > > > * TIOCL_SETSEL - setting the selected region on the terminal > > * TIOCL_PASTESEL - pasting the contents of the selected region into > > the input buffer > > * TIOCL_SELLOADLUT - changing word-by-word selection behaviour > > > > The security problem mitigated is similar to the security risks caused > > by TIOCSTI, which, since kernel 6.2, can be disabled with > > CONFIG_LEGACY_TIOCSTI=n. > > > > Signed-off-by: Hanno Böck <hanno@xxxxxxxxx> > > Signed-off-by: Günther Noack <gnoack@xxxxxxxxxx> > > The SoB rules are tricky, you cannot have a Signed-off-by if you are not > in the From/Author or Committer or Co-Developed-by fields: > https://docs.kernel.org/process/submitting-patches.html#when-to-use-acked-by-cc-and-co-developed-by Not true at all, maintainers add their signed-off-by to everything they apply, and you HAVE to add it to a patch that flows through you to someone else, as per the DCO. > It should be: > > Co-Developed-by: Günther Noack <gnoack@xxxxxxxxxx> Not if this person was not a developer on it, no. > Signed-off-by: Günther Noack <gnoack@xxxxxxxxxx> > Signed-off-by: Hanno Böck <hanno@xxxxxxxxx> > > > Tested-by: Günther Noack <gnoack@xxxxxxxxxx> > > This Tested-by should not be required anymore because of your SoB, > which should implicitly stipulate that you tested this patch. > > I'm not sure if it's worth sending another version with only this fix > though, if there is no more issue I guess the maintainer picking it > could fix it. As submitted, it is correct. thanks, greg k-h
