]> git.ipfire.org Git - people/pmueller/ipfire-2.x.git/commitdiff
projects / people / pmueller / ipfire-2.x.git / commitdiff
? search:
summary | shortlog | log | commit | commitdiff | tree
raw | patch | inline | side by side (from parent 1: 254dcba)
linux: Forbid legacy TIOCSTI usage
authorPeter Müller <peter.mueller@ipfire.org>
Sun, 14 Jan 2024 15:59:00 +0000 (15:59 +0000)
committerPeter Müller <peter.mueller@ipfire.org>
Tue, 16 Jan 2024 15:46:37 +0000 (15:46 +0000)
To quote from the kernel documentation:

> Historically the kernel has allowed TIOCSTI, which will push
> characters into a controlling TTY. This continues to be used
> as a malicious privilege escalation mechanism, and provides no
> meaningful real-world utility any more. Its use is considered
> a dangerous legacy operation, and can be disabled on most
> systems.
>
> Say Y here only if you have confirmed that your system's
> userspace depends on this functionality to continue operating
> normally.
>
> Processes which run with CAP_SYS_ADMIN, such as BRLTTY, can
> use TIOCSTI even when this is set to N.
>
> This functionality can be changed at runtime with the
> dev.tty.legacy_tiocsti sysctl. This configuration option sets
> the default value of the sysctl.

This patch therefore proposes to no longer allow legacy TIOCSTI usage
in IPFire, given its security implications and the apparent lack of
legitimate usage.

Signed-off-by: Peter Müller <peter.mueller@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
config/kernel/kernel.config.aarch64-ipfire patch | blob | blame | history
config/kernel/kernel.config.riscv64-ipfire patch | blob | blame | history
config/kernel/kernel.config.x86_64-ipfire patch | blob | blame | history
config/rootfiles/common/aarch64/linux patch | blob | blame | history
config/rootfiles/common/riscv64/linux patch | blob | blame | history
config/rootfiles/common/x86_64/linux patch | blob | blame | history

diff --git a/config/kernel/kernel.config.aarch64-ipfire b/config/kernel/kernel.config.aarch64-ipfire
index 9f381a071e09021bf3b265d055a6b1c8d464b2d6..1d32ef338577e265c357c5e3c1e46c7d7829e483 100644 (file)
--- a/config/kernel/kernel.config.aarch64-ipfire
+++ b/config/kernel/kernel.config.aarch64-ipfire
@@ -3575,7 +3575,7 @@ CONFIG_HW_CONSOLE=y
 CONFIG_VT_HW_CONSOLE_BINDING=y
 CONFIG_UNIX98_PTYS=y
 # CONFIG_LEGACY_PTYS is not set
-CONFIG_LEGACY_TIOCSTI=y
+# CONFIG_LEGACY_TIOCSTI is not set
 # CONFIG_LDISC_AUTOLOAD is not set
 
 #
diff --git a/config/kernel/kernel.config.riscv64-ipfire b/config/kernel/kernel.config.riscv64-ipfire
index 24b7c412c24d3190e949a2353375b2700cfb8fef..21639e58469a96ebdf443e798baf6849f4937739 100644 (file)
--- a/config/kernel/kernel.config.riscv64-ipfire
+++ b/config/kernel/kernel.config.riscv64-ipfire
@@ -3249,7 +3249,7 @@ CONFIG_HW_CONSOLE=y
 CONFIG_VT_HW_CONSOLE_BINDING=y
 CONFIG_UNIX98_PTYS=y
 # CONFIG_LEGACY_PTYS is not set
-CONFIG_LEGACY_TIOCSTI=y
+# CONFIG_LEGACY_TIOCSTI is not set
 # CONFIG_LDISC_AUTOLOAD is not set
 
 #
diff --git a/config/kernel/kernel.config.x86_64-ipfire b/config/kernel/kernel.config.x86_64-ipfire
index bc6ebb1d5048602d9202df37b444b906630e75b0..071efb9caa5681ee8aecd7e36e5c239738830b20 100644 (file)
--- a/config/kernel/kernel.config.x86_64-ipfire
+++ b/config/kernel/kernel.config.x86_64-ipfire
@@ -3497,7 +3497,7 @@ CONFIG_HW_CONSOLE=y
 CONFIG_VT_HW_CONSOLE_BINDING=y
 CONFIG_UNIX98_PTYS=y
 # CONFIG_LEGACY_PTYS is not set
-CONFIG_LEGACY_TIOCSTI=y
+# CONFIG_LEGACY_TIOCSTI is not set
 # CONFIG_LDISC_AUTOLOAD is not set
 
 #
diff --git a/config/rootfiles/common/aarch64/linux b/config/rootfiles/common/aarch64/linux
index 5d2d36a46da5b30f967a43494e9127fd825240cc..a32c3770eab836443fb169b91ce00a1a4c109f02 100644 (file)
--- a/config/rootfiles/common/aarch64/linux
+++ b/config/rootfiles/common/aarch64/linux
@@ -9185,7 +9185,6 @@ etc/modprobe.d/ipv6.conf
 #lib/modules/KVER-ipfire/build/include/config/LEDS_TRIGGER_TTY
 #lib/modules/KVER-ipfire/build/include/config/LED_TRIGGER_PHY
 #lib/modules/KVER-ipfire/build/include/config/LEGACY_DIRECT_IO
-#lib/modules/KVER-ipfire/build/include/config/LEGACY_TIOCSTI
 #lib/modules/KVER-ipfire/build/include/config/LIB80211
 #lib/modules/KVER-ipfire/build/include/config/LIB80211_CRYPT_CCMP
 #lib/modules/KVER-ipfire/build/include/config/LIB80211_CRYPT_TKIP
diff --git a/config/rootfiles/common/riscv64/linux b/config/rootfiles/common/riscv64/linux
index c2e0191afadad1836c6e9b1338627a09b10d3d09..5e1ac921cb4ba43e28da12d8b7a199bc983ae96d 100644 (file)
--- a/config/rootfiles/common/riscv64/linux
+++ b/config/rootfiles/common/riscv64/linux
@@ -8345,7 +8345,6 @@ etc/modprobe.d/ipv6.conf
 #lib/modules/KVER-ipfire/build/include/config/LEDS_USER
 #lib/modules/KVER-ipfire/build/include/config/LED_TRIGGER_PHY
 #lib/modules/KVER-ipfire/build/include/config/LEGACY_DIRECT_IO
-#lib/modules/KVER-ipfire/build/include/config/LEGACY_TIOCSTI
 #lib/modules/KVER-ipfire/build/include/config/LIB80211
 #lib/modules/KVER-ipfire/build/include/config/LIB80211_CRYPT_CCMP
 #lib/modules/KVER-ipfire/build/include/config/LIB80211_CRYPT_TKIP
diff --git a/config/rootfiles/common/x86_64/linux b/config/rootfiles/common/x86_64/linux
index a51f3487fe23bdcc666d5982def3cb78bdf3cbeb..f3a8dea19cdd14da361e7cb151e6d308abad0d75 100644 (file)
--- a/config/rootfiles/common/x86_64/linux
+++ b/config/rootfiles/common/x86_64/linux
@@ -8996,7 +8996,6 @@ etc/modprobe.d/ipv6.conf
 #lib/modules/KVER-ipfire/build/include/config/LEDS_USER
 #lib/modules/KVER-ipfire/build/include/config/LED_TRIGGER_PHY
 #lib/modules/KVER-ipfire/build/include/config/LEGACY_DIRECT_IO
-#lib/modules/KVER-ipfire/build/include/config/LEGACY_TIOCSTI
 #lib/modules/KVER-ipfire/build/include/config/LEGACY_VSYSCALL_NONE
 #lib/modules/KVER-ipfire/build/include/config/LIB80211
 #lib/modules/KVER-ipfire/build/include/config/LIB80211_CRYPT_CCMP
Peter's tree of IPFire 2.x