Re: Fixing su + runuser vulnerability CVE-2016-2779

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



* Karel Zak:

>  I have tried to send tty FD to another process by unix socket and the 
>  ioctl result is EPERM. See the test_tiocsti below. It seems only root
>  can do it (try suid the test program).
>
>  session A:
>     ./test_tiocsti --receive

I think the recipient has to give up its controlling terminal, become
a session leader, and then reopen the passed terminal (from
/proc/self/fd, if it's not reachable from /dev/pts).  This way, you
should be able to do away with the root requirement.

>  session B:
>     runuser -u kzak -- ./test_tiocsti --send
>
>>  The ioctl should be fired in the hell... :-)
>
>  This is still true.

The kernel implementation doesn't even do error checking.  Surely it
can fail if there isn't enough memory in the destination buffer ...
--
To unsubscribe from this list: send the line "unsubscribe util-linux" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at  http://vger.kernel.org/majordomo-info.html



[Index of Archives]     [Netdev]     [Ethernet Bridging]     [Linux Wireless]     [Kernel Newbies]     [Security]     [Linux for Hams]     [Netfilter]     [Bugtraq]     [Yosemite News]     [MIPS Linux]     [ARM Linux]     [Linux RAID]     [Linux Admin]     [Samba]

  Powered by Linux