On Tue, Apr 12, 2016 at 10:44 AM, Andy Lutomirski <l...@amacapital.net> wrote:
> Linus, you said that people who want to protect their pts should deny
> execute. So I set it up:
>
> # ls -l
> total 0
> crw-------. 1 root root 5, 2 Apr 12 10:38 ptmx
> drwx------. 2 root root 0 Apr 2 11:35 pts
No you didn't. You're root, and you still have access to /dev/ptmx.
> And there goes your protection. So the whole /dev directory would
> have to deny execute to protect against this.
Exactly. That's what I'm saying. If you want your ptmx to be private,
you need to make your /dev private.
Now, you can avoid the other attack that was talked about (which
involved bind-mounting the pts/ directory somewhere else) by making
just the pts/ directory non-execute, because afaik bind mount requires
the ability to do the lookup.
> But I think that gating this on mount options might be fine. If
> devpts is mounted with newinstance, then /dev/ptmx *already doesn't
> work for it*, right? So can we just say that the magic ptmx ->
> pts/ptmx redirect doesn't work if the pts filesystem in question is
> mounted with newinstance?
No, the problem that started this whole discussion is that
(a) newinstance should go the f*ck away, because this whole duality is broken.
(b) people wanted single instances and we couldn't even enable
default kernel support for DEVPTS_MULTIPLE_INSTANCES, because multiple
instances just don't work with /dev/ptmx.
So what I want to happen is to "just make /dev/ptmx work". Get rid of
the broken "single instance" crap. The only reason it exists is
exactly because /dev/ptmx does not work.
I think the current situation is completely and utterly broken. We
should never have done what we did. I want to *fix* the kernel, not
add random new magic crap.
And I think we _can_ fix the kernel. Not add new mount options that
people already don't use (because they are broken for the normal
situation).
Linus
