webadmin/bpfire
1
0
Fork 0
mirror of https://github.com/vincentmli/bpfire.git synced 2026-04-17 14:33:00 +02:00
Code Issues Packages Projects Releases Wiki Activity

linux: Forbid legacy TIOCSTI usage

Browse Source 
To quote from the kernel documentation:

> Historically the kernel has allowed TIOCSTI, which will push
> characters into a controlling TTY. This continues to be used
> as a malicious privilege escalation mechanism, and provides no
> meaningful real-world utility any more. Its use is considered
> a dangerous legacy operation, and can be disabled on most
> systems.
>
> Say Y here only if you have confirmed that your system's
> userspace depends on this functionality to continue operating
> normally.
>
> Processes which run with CAP_SYS_ADMIN, such as BRLTTY, can
> use TIOCSTI even when this is set to N.
>
> This functionality can be changed at runtime with the
> dev.tty.legacy_tiocsti sysctl. This configuration option sets
> the default value of the sysctl.

This patch therefore proposes to no longer allow legacy TIOCSTI usage
in IPFire, given its security implications and the apparent lack of
legitimate usage.

Signed-off-by: Peter Müller <peter.mueller@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
This commit is contained in:
Peter Müller
2024-01-14 15:59:00 +00:00
parent 254dcbaac8
commit bca096b453
6 changed files with 3 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
config/kernel/kernel.config.aarch64-ipfire
View File

@@ -3575,7 +3575,7 @@ CONFIG_HW_CONSOLE=y
CONFIG_VT_HW_CONSOLE_BINDING=y
CONFIG_UNIX98_PTYS=y
# CONFIG_LEGACY_PTYS is not set
CONFIG_LEGACY_TIOCSTI=y
# CONFIG_LEGACY_TIOCSTI is not set
# CONFIG_LDISC_AUTOLOAD is not set
#

2
config/kernel/kernel.config.riscv64-ipfire
View File

@@ -3249,7 +3249,7 @@ CONFIG_HW_CONSOLE=y
CONFIG_VT_HW_CONSOLE_BINDING=y
CONFIG_UNIX98_PTYS=y
# CONFIG_LEGACY_PTYS is not set
CONFIG_LEGACY_TIOCSTI=y
# CONFIG_LEGACY_TIOCSTI is not set
# CONFIG_LDISC_AUTOLOAD is not set
#

2
config/kernel/kernel.config.x86_64-ipfire
View File

@@ -3497,7 +3497,7 @@ CONFIG_HW_CONSOLE=y
CONFIG_VT_HW_CONSOLE_BINDING=y
CONFIG_UNIX98_PTYS=y
# CONFIG_LEGACY_PTYS is not set
CONFIG_LEGACY_TIOCSTI=y
# CONFIG_LEGACY_TIOCSTI is not set
# CONFIG_LDISC_AUTOLOAD is not set
#

1
config/rootfiles/common/aarch64/linux
View File

@@ -9185,7 +9185,6 @@ etc/modprobe.d/ipv6.conf
#lib/modules/KVER-ipfire/build/include/config/LEDS_TRIGGER_TTY
#lib/modules/KVER-ipfire/build/include/config/LED_TRIGGER_PHY
#lib/modules/KVER-ipfire/build/include/config/LEGACY_DIRECT_IO
#lib/modules/KVER-ipfire/build/include/config/LEGACY_TIOCSTI
#lib/modules/KVER-ipfire/build/include/config/LIB80211
#lib/modules/KVER-ipfire/build/include/config/LIB80211_CRYPT_CCMP
#lib/modules/KVER-ipfire/build/include/config/LIB80211_CRYPT_TKIP

1
config/rootfiles/common/riscv64/linux
View File

@@ -8345,7 +8345,6 @@ etc/modprobe.d/ipv6.conf
#lib/modules/KVER-ipfire/build/include/config/LEDS_USER
#lib/modules/KVER-ipfire/build/include/config/LED_TRIGGER_PHY
#lib/modules/KVER-ipfire/build/include/config/LEGACY_DIRECT_IO
#lib/modules/KVER-ipfire/build/include/config/LEGACY_TIOCSTI
#lib/modules/KVER-ipfire/build/include/config/LIB80211
#lib/modules/KVER-ipfire/build/include/config/LIB80211_CRYPT_CCMP
#lib/modules/KVER-ipfire/build/include/config/LIB80211_CRYPT_TKIP

1
config/rootfiles/common/x86_64/linux
View File

@@ -8996,7 +8996,6 @@ etc/modprobe.d/ipv6.conf
#lib/modules/KVER-ipfire/build/include/config/LEDS_USER
#lib/modules/KVER-ipfire/build/include/config/LED_TRIGGER_PHY
#lib/modules/KVER-ipfire/build/include/config/LEGACY_DIRECT_IO
#lib/modules/KVER-ipfire/build/include/config/LEGACY_TIOCSTI
#lib/modules/KVER-ipfire/build/include/config/LEGACY_VSYSCALL_NONE
#lib/modules/KVER-ipfire/build/include/config/LIB80211
#lib/modules/KVER-ipfire/build/include/config/LIB80211_CRYPT_CCMP