From bca096b453809236775b497e0a3e4c7cd5e5437e Mon Sep 17 00:00:00 2001 From: =?utf8?q?Peter=20M=C3=BCller?= Date: Sun, 14 Jan 2024 15:59:00 +0000 Subject: [PATCH] linux: Forbid legacy TIOCSTI usage MIME-Version: 1.0 Content-Type: text/plain; charset=utf8 Content-Transfer-Encoding: 8bit To quote from the kernel documentation: > Historically the kernel has allowed TIOCSTI, which will push > characters into a controlling TTY. This continues to be used > as a malicious privilege escalation mechanism, and provides no > meaningful real-world utility any more. Its use is considered > a dangerous legacy operation, and can be disabled on most > systems. > > Say Y here only if you have confirmed that your system's > userspace depends on this functionality to continue operating > normally. > > Processes which run with CAP_SYS_ADMIN, such as BRLTTY, can > use TIOCSTI even when this is set to N. > > This functionality can be changed at runtime with the > dev.tty.legacy_tiocsti sysctl. This configuration option sets > the default value of the sysctl. This patch therefore proposes to no longer allow legacy TIOCSTI usage in IPFire, given its security implications and the apparent lack of legitimate usage. Signed-off-by: Peter Müller Signed-off-by: Michael Tremer --- config/kernel/kernel.config.aarch64-ipfire | 2 +- config/kernel/kernel.config.riscv64-ipfire | 2 +- config/kernel/kernel.config.x86_64-ipfire | 2 +- config/rootfiles/common/aarch64/linux | 1 - config/rootfiles/common/riscv64/linux | 1 - config/rootfiles/common/x86_64/linux | 1 - 6 files changed, 3 insertions(+), 6 deletions(-) diff --git a/config/kernel/kernel.config.aarch64-ipfire b/config/kernel/kernel.config.aarch64-ipfire index 9f381a071e..1d32ef3385 100644 --- a/config/kernel/kernel.config.aarch64-ipfire +++ b/config/kernel/kernel.config.aarch64-ipfire @@ -3575,7 +3575,7 @@ CONFIG_HW_CONSOLE=y CONFIG_VT_HW_CONSOLE_BINDING=y CONFIG_UNIX98_PTYS=y # CONFIG_LEGACY_PTYS is not set -CONFIG_LEGACY_TIOCSTI=y +# CONFIG_LEGACY_TIOCSTI is not set # CONFIG_LDISC_AUTOLOAD is not set # diff --git a/config/kernel/kernel.config.riscv64-ipfire b/config/kernel/kernel.config.riscv64-ipfire index 24b7c412c2..21639e5846 100644 --- a/config/kernel/kernel.config.riscv64-ipfire +++ b/config/kernel/kernel.config.riscv64-ipfire @@ -3249,7 +3249,7 @@ CONFIG_HW_CONSOLE=y CONFIG_VT_HW_CONSOLE_BINDING=y CONFIG_UNIX98_PTYS=y # CONFIG_LEGACY_PTYS is not set -CONFIG_LEGACY_TIOCSTI=y +# CONFIG_LEGACY_TIOCSTI is not set # CONFIG_LDISC_AUTOLOAD is not set # diff --git a/config/kernel/kernel.config.x86_64-ipfire b/config/kernel/kernel.config.x86_64-ipfire index bc6ebb1d50..071efb9caa 100644 --- a/config/kernel/kernel.config.x86_64-ipfire +++ b/config/kernel/kernel.config.x86_64-ipfire @@ -3497,7 +3497,7 @@ CONFIG_HW_CONSOLE=y CONFIG_VT_HW_CONSOLE_BINDING=y CONFIG_UNIX98_PTYS=y # CONFIG_LEGACY_PTYS is not set -CONFIG_LEGACY_TIOCSTI=y +# CONFIG_LEGACY_TIOCSTI is not set # CONFIG_LDISC_AUTOLOAD is not set # diff --git a/config/rootfiles/common/aarch64/linux b/config/rootfiles/common/aarch64/linux index 5d2d36a46d..a32c3770ea 100644 --- a/config/rootfiles/common/aarch64/linux +++ b/config/rootfiles/common/aarch64/linux @@ -9185,7 +9185,6 @@ etc/modprobe.d/ipv6.conf #lib/modules/KVER-ipfire/build/include/config/LEDS_TRIGGER_TTY #lib/modules/KVER-ipfire/build/include/config/LED_TRIGGER_PHY #lib/modules/KVER-ipfire/build/include/config/LEGACY_DIRECT_IO -#lib/modules/KVER-ipfire/build/include/config/LEGACY_TIOCSTI #lib/modules/KVER-ipfire/build/include/config/LIB80211 #lib/modules/KVER-ipfire/build/include/config/LIB80211_CRYPT_CCMP #lib/modules/KVER-ipfire/build/include/config/LIB80211_CRYPT_TKIP diff --git a/config/rootfiles/common/riscv64/linux b/config/rootfiles/common/riscv64/linux index c2e0191afa..5e1ac921cb 100644 --- a/config/rootfiles/common/riscv64/linux +++ b/config/rootfiles/common/riscv64/linux @@ -8345,7 +8345,6 @@ etc/modprobe.d/ipv6.conf #lib/modules/KVER-ipfire/build/include/config/LEDS_USER #lib/modules/KVER-ipfire/build/include/config/LED_TRIGGER_PHY #lib/modules/KVER-ipfire/build/include/config/LEGACY_DIRECT_IO -#lib/modules/KVER-ipfire/build/include/config/LEGACY_TIOCSTI #lib/modules/KVER-ipfire/build/include/config/LIB80211 #lib/modules/KVER-ipfire/build/include/config/LIB80211_CRYPT_CCMP #lib/modules/KVER-ipfire/build/include/config/LIB80211_CRYPT_TKIP diff --git a/config/rootfiles/common/x86_64/linux b/config/rootfiles/common/x86_64/linux index a51f3487fe..f3a8dea19c 100644 --- a/config/rootfiles/common/x86_64/linux +++ b/config/rootfiles/common/x86_64/linux @@ -8996,7 +8996,6 @@ etc/modprobe.d/ipv6.conf #lib/modules/KVER-ipfire/build/include/config/LEDS_USER #lib/modules/KVER-ipfire/build/include/config/LED_TRIGGER_PHY #lib/modules/KVER-ipfire/build/include/config/LEGACY_DIRECT_IO -#lib/modules/KVER-ipfire/build/include/config/LEGACY_TIOCSTI #lib/modules/KVER-ipfire/build/include/config/LEGACY_VSYSCALL_NONE #lib/modules/KVER-ipfire/build/include/config/LIB80211 #lib/modules/KVER-ipfire/build/include/config/LIB80211_CRYPT_CCMP -- 2.39.2