Re: TTY pushback vulnerabilities / TIOCSTI

[Casper Dik <casper.dik () oracle com>]

> On Wed, 15 Mar 2023, Fabian Keil wrote:

> > In ElectroBSD I removed TIOCSTI support in 2017 [0] and haven't noticed
> > any problems.

> I hate tossing out functionality; would you not make it a privileged
> operation instead?

> -- Dave


I think it makes it mostly useless.

In Solaris we've changed how TIOCSTI works; when a process reads the
packet with the stuffed input, it then checks the credential of the
sender.   So while the stuffed input is still echoed but ignored:

# su nobody -c tiocsti
exit
echo Payload as `whoami`
#

But when having root calling tciosti, you get:

# su root -c tiocsti
exit
echo Payload as `whoami`
# exit
Payload as root

(The exit here is not needed)

Casper