Re: [PATCH] Restrict access to TIOCLINUX

On Sun, Apr 02, 2023 at 07:33:10PM +0200, Hanno Böck wrote:
> On Sun, 2 Apr 2023 19:23:44 +0200
> Greg KH <[email protected]> wrote:
> 
> > > Do you have other proposals how to fix this issue? One could
> > > introduce an option like for TIOCSTI that allows disabling
> > > selection features by default.  
> > 
> > What exact issue are you trying to fix here?
> 
> The fact that the selection features of TIOCLINUX can be used for
> privilege escalation.

Only if you had root permissions already, and then go to try to run
something using su or sudo as someone with less permission, right?

And as you already had permissions before, it's not really an
excalation, or am I missing something?

> I already mentioned this in the original patch description, but I think
> the minitty.c example here illustrates this well:
> https://www.openwall.com/lists/oss-security/2023/03/14/3
> 
> Compile it, do
> sudo -u [anynonprivilegeduser] ./minitty
> 
> It'll execute shell code with root permission.

That doesn't work if you run it from a user without root permissions to
start with, right?

thanks,

greg k-h