patch "tty: add TIOCGPTPEER ioctl" added to tty-next

PATCH Aleksa Sarai 1 participant 1 message Jun 9, 2017 2 messages not in the archive

Subsystems (9)

PowerPC MIPS TTY layer and serial drivers SuperH +5 more subsystems

lore

Share & tools

lore

A message that is not in the archive (sent off-list or not yet received): [email protected]

Aleksa Sarai

author Applied

2017-06-09 18:39 UTC #2 lore raw

Just a heads up to any container runtime developers (I forgot to Cc this list), I added a new tty_ioctl that will make it possible for userspace processes to safely avoid the whole "is /dev/ trustworthy" problem when it comes to potentially hostile namespaces.

I would recommend using this if you can (and you've implemented pty creation inside the container with nsenter or similar functionality). If any of you are going to Linux Plumbers, Christian Brauner and myself will (likely) be talking about a whole class of similar problems when trying to write a runtime that is secure against hostile containers and how we can work to fix them as well.

-------- Forwarded Message --------
Subject: patch "tty: add TIOCGPTPEER ioctl" added to tty-next
Date: Fri, 09 Jun 2017 20:09:10 +0200
From: [email protected]
To: [email protected], christian.brauner-GeWIH/[email protected], [email protected], vrothberg-IBi9RG/[email protected]

This is a note to let you know that I've just added the patch titled

tty: add TIOCGPTPEER ioctl

to my tty git tree which can be found at
git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty.git
in the tty-next branch.

The patch will show up in the next release of the linux-next tree (usually sometime within the next 24 hours during the week.)

The patch will also be merged in the next major kernel release during the merge window.

If you have any questions about this process, please let me know.

From 54ebbfb1603415d9953c150535850d30609ef077 Mon Sep 17 00:00:00 2001
From: Aleksa Sarai <[email protected]>
Date: Sun, 4 Jun 2017 00:15:15 +1000
Subject: tty: add TIOCGPTPEER ioctl

When opening the slave end of a PTY, it is not possible for userspace to safely ensure that /dev/pts/$num is actually a slave (in cases where the mount namespace in which devpts was mounted is controlled by an untrusted process). In addition, there are several unresolvable race conditions if userspace were to attempt to detect attacks through stat(2) and other similar methods [in addition it is not clear how userspace could detect attacks involving FUSE].

Resolve this by providing an interface for userpace to safely open the "peer" end of a PTY file descriptor by using the dentry cached by devpts. Since it is not possible to have an open master PTY without having its slave exposed in /dev/pts this interface is safe. This interface currently does not provide a way to get the master pty (since it is not clear whether such an interface is safe or even useful).

Cc Christian Brauner <christian.brauner-GeWIH/[email protected]>

Cc Valentin Rothberg <vrothberg-IBi9RG/[email protected]>

Signed-off-by Aleksa Sarai <[email protected]>

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 arch/alpha/include/uapi/asm/ioctls.h   |  1 +
 arch/mips/include/uapi/asm/ioctls.h    |  1 +
 arch/parisc/include/uapi/asm/ioctls.h  |  1 +
 arch/powerpc/include/uapi/asm/ioctls.h |  1 +
 arch/sh/include/uapi/asm/ioctls.h      |  1 +
 arch/sparc/include/uapi/asm/ioctls.h   |  3 +-
 arch/xtensa/include/uapi/asm/ioctls.h  |  1 +
 drivers/tty/pty.c                      | 71 
++++++++++++++++++++++++++++++++--
 include/uapi/asm-generic/ioctls.h      |  1 +
 9 files changed, 76 insertions(+), 5 deletions(-)

arch/alpha/include/uapi/asm/ioctls.h +1 -0

index f30c94ae1bdb..ff67b8373bf7 100644
@@ -100,6 +100,7 @@
 #define TIOCGPKT	_IOR('T', 0x38, int) /* Get packet mode state */
 #define TIOCGPTLCK	_IOR('T', 0x39, int) /* Get Pty lock state */
 #define TIOCGEXCL	_IOR('T', 0x40, int) /* Get exclusive mode state */
+#define TIOCGPTPEER	_IOR('T', 0x41, int) /* Safely open the slave */
  #define TIOCSERCONFIG	0x5453
 #define TIOCSERGWILD	0x5454

arch/mips/include/uapi/asm/ioctls.h +1 -0

index 740219c2c894..68e19b689a00 100644
@@ -91,6 +91,7 @@
 #define TIOCGPKT	_IOR('T', 0x38, int) /* Get packet mode state */
 #define TIOCGPTLCK	_IOR('T', 0x39, int) /* Get Pty lock state */
 #define TIOCGEXCL	_IOR('T', 0x40, int) /* Get exclusive mode state */
+#define TIOCGPTPEER	_IOR('T', 0x41, int) /* Safely open the slave */
  /* I hope the range from 0x5480 on is free ... */
 #define TIOCSCTTY	0x5480		/* become controlling tty */

arch/parisc/include/uapi/asm/ioctls.h +1 -0

index b6572f051b67..674c68a5bbd0 100644
@@ -60,6 +60,7 @@
 #define TIOCGPKT	_IOR('T', 0x38, int) /* Get packet mode state */
 #define TIOCGPTLCK	_IOR('T', 0x39, int) /* Get Pty lock state */
 #define TIOCGEXCL	_IOR('T', 0x40, int) /* Get exclusive mode state */
+#define TIOCGPTPEER	_IOR('T', 0x41, int) /* Safely open the slave */
  #define FIONCLEX	0x5450  /* these numbers need to be adjusted. */
 #define FIOCLEX		0x5451

arch/powerpc/include/uapi/asm/ioctls.h +1 -0

index 49a25796a61a..bfd609a3e928 100644
@@ -100,6 +100,7 @@
 #define TIOCGPKT	_IOR('T', 0x38, int) /* Get packet mode state */
 #define TIOCGPTLCK	_IOR('T', 0x39, int) /* Get Pty lock state */
 #define TIOCGEXCL	_IOR('T', 0x40, int) /* Get exclusive mode state */
+#define TIOCGPTPEER	_IOR('T', 0x41, int) /* Safely open the slave */
  #define TIOCSERCONFIG	0x5453
 #define TIOCSERGWILD	0x5454

arch/sh/include/uapi/asm/ioctls.h +1 -0

index c9903e56ccf4..eec7901e9e65 100644
@@ -93,6 +93,7 @@
 #define TIOCGPKT	_IOR('T', 0x38, int) /* Get packet mode state */
 #define TIOCGPTLCK	_IOR('T', 0x39, int) /* Get Pty lock state */
 #define TIOCGEXCL	_IOR('T', 0x40, int) /* Get exclusive mode state */
+#define TIOCGPTPEER	_IOR('T', 0x41, int) /* Safely open the slave */
  #define TIOCSERCONFIG	_IO('T', 83) /* 0x5453 */
 #define TIOCSERGWILD	_IOR('T', 84,  int) /* 0x5454 */

arch/sparc/include/uapi/asm/ioctls.h +2 -0

index 06b3f6c3bb9a..6d27398632ea 100644
@@ -27,7 +27,7 @@
 #define TIOCGRS485	_IOR('T', 0x41, struct serial_rs485)
 #define TIOCSRS485	_IOWR('T', 0x42, struct serial_rs485)
 -/* Note that all the ioctls that are not available in Linux have a 
+/* Note that all the ioctls that are not available in Linux have a
  * double underscore on the front to: a) avoid some programs to
  * think we support some ioctls under Linux (autoconfiguration stuff)
  */

@@ -88,6 +88,7 @@
 #define TIOCGPTN	_IOR('t', 134, unsigned int) /* Get Pty Number */
 #define TIOCSPTLCK	_IOW('t', 135, int) /* Lock/unlock PTY */
 #define TIOCSIG		_IOW('t', 136, int) /* Generate signal on Pty slave */
+#define TIOCGPTPEER	_IOR('t', 137, int) /* Safely open the slave */
  /* Little f */
 #define FIOCLEX		_IO('f', 1)

arch/xtensa/include/uapi/asm/ioctls.h +1 -0

index 518954e74e6d..98b004e24e85 100644
@@ -105,6 +105,7 @@
 #define TIOCGPKT	_IOR('T', 0x38, int) /* Get packet mode state */
 #define TIOCGPTLCK	_IOR('T', 0x39, int) /* Get Pty lock state */
 #define TIOCGEXCL	_IOR('T', 0x40, int) /* Get exclusive mode state */
+#define TIOCGPTPEER	_IOR('T', 0x41, int) /* Safely open the slave */
  #define TIOCSERCONFIG	_IO('T', 83)
 #define TIOCSERGWILD	_IOR('T', 84,  int)

drivers/tty/pty.c +66 -4

110 lines not on this page · raw message

include/uapi/asm-generic/ioctls.h +1 -0

index 143dacbb7d9a..06d5f7ddf84e 100644
@@ -77,6 +77,7 @@
 #define TIOCGPKT	_IOR('T', 0x38, int) /* Get packet mode state */
 #define TIOCGPTLCK	_IOR('T', 0x39, int) /* Get Pty lock state */
 #define TIOCGEXCL	_IOR('T', 0x40, int) /* Get exclusive mode state */
+#define TIOCGPTPEER	_IOR('T', 0x41, int) /* Safely open the slave */
  #define FIONCLEX	0x5450
 #define FIOCLEX		0x5451

Signature · 10 lines

2.13.1




-- 
Aleksa Sarai
Software Engineer (Containers)
SUSE Linux GmbH
https://www.cyphar.com/