Re: [PATCH 0/1] openpty: use TIOCGPTPEER to open slave side fd

[Rich Felker <dalias@libc.org>]

On Fri, Sep 01, 2017 at 12:00:49PM -0400, Rich Felker wrote:
> On Fri, Sep 01, 2017 at 05:35:57PM +0200, Christian Brauner wrote:
> > Hi,
> > 
> > Newer kernels expose the ioctl TIOCGPTPEER [1] call to userspace which allows to
> > safely allocate a file descriptor for a pty slave based solely on the master
> > file descriptor. This allows us to avoid path-based operations and makes this
> > function a lot safer in the face of devpts mounts in different mount namespaces.
> > 
> > [1]: https://patchwork.kernel.org/patch/9760743/
> > 
> [....]
> Otherwise this looks like a good change, but I do wonder a bit about
> how the cases where it would help are intended to work, since the

Actually I'm also rather concerned about security of this whole kernel
patch in general.

Consider the case where a daemon running as root performs
posix_openpt, chowns the corresponding ptsname to a user and hands the
pts off to a user process, then drops from root to nobody, possibly
after chrooting itself or similar. In this scenario it should not be
able to open the user's pts, but with TIOCGPTPEER it can bypass the
filesystem permissions and open it.

I'm not sure what mischief this lets you achieve, but it seems like a
violation of an important permissions invariant...

Rich