oss-sec mailing list archives
Re: Access to /dev/pts devices via pt_chown and user namespaces
From: halfdog <me () halfdog net>
Date: Wed, 24 Feb 2016 05:43:04 +0000
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Dmitry V. Levin wrote:
On Tue, Feb 23, 2016 at 07:17:54PM +0300, Solar Designer wrote:On Tue, Feb 23, 2016 at 12:03:54PM +0000, halfdog wrote:Sending content from [0] also to oss-security as requested last time:Thank you. This public disclosure is very late, though. I didn't realize you were still holding some of your findings on this.With Ubuntu Wily and earlier, /usr/lib/pt_chown was used to change ownership of slave pts devices in /dev/pts to the same uid holding the master file descriptor for the slave.I think pt_chown is only needed for legacy BSD pty's, and no longer needed for Unix 98 pty's that Linux systems use these days. Perhaps it should be dropped from upstream glibc by now.Just for the record, pt_chown is not enabled by default in upstream glibc starting with glibc-2.18, one has to specify --enable-pt_chown configure option explicitly to build pt_chown.
Thanks for that information. So for pt_chown, this could hopefully be just an Ubuntu issue. Should we assign an CVE for that? On the other hand, the TIOCGPTN ioctl still is problematic with USERNS, also for other tools. I just started with pt_chown for demonstration because it is SUID, perhaps there are other programs using this ioctl. Should information about this risk/attack method just be added to the kernel docs/man-page of TIOCGPTN or is it a separate vulnerability with need for addressing (another CVE?).
glibc documentation clearly states that "the use of pt_chown introduces additional security risks to the system and you should enable it only if you understand and accept those risks": https://www.gnu.org/software/libc/manual/html_node/Configuring-and-compiling.html#index-grantpt-1
Another
argument for having some community check tool + procedure (sketched in mail before) to make mistakes only once (when not everyone is reading all the docs). hd - -- http://www.halfdog.net/ PGP: 156A AE98 B91F 0114 FE88 2BD8 C459 9386 feed a bee -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iEYEARECAAYFAlbNQt0ACgkQxFmThv7tq+7cYwCeIz3bGFV7lJwTS6naQrzLfAoc h7EAnioQTLYVtsNJ5jX0+hiW9QekLUVg =B5H+ -----END PGP SIGNATURE-----
Current thread:
- Access to /dev/pts devices via pt_chown and user namespaces halfdog (Feb 23)
- Re: Access to /dev/pts devices via pt_chown and user namespaces Solar Designer (Feb 23)
- Re: Access to /dev/pts devices via pt_chown and user namespaces Dmitry V. Levin (Feb 23)
- Re: Access to /dev/pts devices via pt_chown and user namespaces halfdog (Feb 23)
- Re: Access to /dev/pts devices via pt_chown and user namespaces Simon McVittie (Feb 23)
- Re: Access to /dev/pts devices via pt_chown and user namespaces Dmitry V. Levin (Feb 24)
- Re: Access to /dev/pts devices via pt_chown and user namespaces Serge Hallyn (Feb 24)
- Re: Access to /dev/pts devices via pt_chown and user namespaces Jakub Wilk (Feb 27)
- Re: Access to /dev/pts devices via pt_chown and user namespaces Dmitry V. Levin (Feb 23)
- Re: Access to /dev/pts devices via pt_chown and user namespaces Solar Designer (Feb 23)
- Re: Access to /dev/pts devices via pt_chown and user namespaces Alan Coopersmith (Feb 23)