From mboxrd@z Thu Jan 1 00:00:00 1970 X-Msuck: nntp://news.gmane.org/gmane.linux.lib.musl.general/11898 Path: news.gmane.org!.POSTED!not-for-mail From: Rich Felker Newsgroups: gmane.linux.lib.musl.general Subject: Re: [PATCH 0/1] openpty: use TIOCGPTPEER to open slave side fd Date: Fri, 1 Sep 2017 12:07:16 -0400 Message-ID: <20170901160716.GL1627@brightrain.aerifal.cx> References: <20170901153558.29715-1-christian.brauner@ubuntu.com> <20170901160049.GK1627@brightrain.aerifal.cx> Reply-To: musl@lists.openwall.com NNTP-Posting-Host: blaine.gmane.org Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii X-Trace: blaine.gmane.org 1504282054 16417 195.159.176.226 (1 Sep 2017 16:07:34 GMT) X-Complaints-To: usenet@blaine.gmane.org NNTP-Posting-Date: Fri, 1 Sep 2017 16:07:34 +0000 (UTC) User-Agent: Mutt/1.5.21 (2010-09-15) To: musl@lists.openwall.com Original-X-From: musl-return-11911-gllmg-musl=m.gmane.org@lists.openwall.com Fri Sep 01 18:07:25 2017 Return-path: Envelope-to: gllmg-musl@m.gmane.org Original-Received: from mother.openwall.net ([195.42.179.200]) by blaine.gmane.org with smtp (Exim 4.84_2) (envelope-from ) id 1dnoTb-0003nh-Ob for gllmg-musl@m.gmane.org; Fri, 01 Sep 2017 18:07:23 +0200 Original-Received: (qmail 24170 invoked by uid 550); 1 Sep 2017 16:07:28 -0000 Mailing-List: contact musl-help@lists.openwall.com; run by ezmlm Precedence: bulk List-Post: List-Help: List-Unsubscribe: List-Subscribe: List-ID: Original-Received: (qmail 24149 invoked from network); 1 Sep 2017 16:07:28 -0000 Content-Disposition: inline In-Reply-To: <20170901160049.GK1627@brightrain.aerifal.cx> Original-Sender: Rich Felker Xref: news.gmane.org gmane.linux.lib.musl.general:11898 Archived-At: On Fri, Sep 01, 2017 at 12:00:49PM -0400, Rich Felker wrote: > On Fri, Sep 01, 2017 at 05:35:57PM +0200, Christian Brauner wrote: > > Hi, > > > > Newer kernels expose the ioctl TIOCGPTPEER [1] call to userspace which allows to > > safely allocate a file descriptor for a pty slave based solely on the master > > file descriptor. This allows us to avoid path-based operations and makes this > > function a lot safer in the face of devpts mounts in different mount namespaces. > > > > [1]: https://patchwork.kernel.org/patch/9760743/ > > > [....] > Otherwise this looks like a good change, but I do wonder a bit about > how the cases where it would help are intended to work, since the Actually I'm also rather concerned about security of this whole kernel patch in general. Consider the case where a daemon running as root performs posix_openpt, chowns the corresponding ptsname to a user and hands the pts off to a user process, then drops from root to nobody, possibly after chrooting itself or similar. In this scenario it should not be able to open the user's pts, but with TIOCGPTPEER it can bypass the filesystem permissions and open it. I'm not sure what mischief this lets you achieve, but it seems like a violation of an important permissions invariant... Rich