Re: [PATCH] make TIOCSTI ioctl require CAP_SYS_ADMIN

2017-04-22 Thread Serge E. Hallyn
Quoting Matt Brown (m...@nmatt.com): > On 04/21/2017 01:24 AM, Serge E. Hallyn wrote: > >On Fri, Apr 21, 2017 at 01:09:59AM -0400, Matt Brown wrote: > >>On 04/20/2017 01:41 PM, Serge E. Hallyn wrote: > >>>Quoting m...@nmatt.com (m...@nmatt.com): > On 2017-04-20 11:19, Serge E. Hallyn wrote: > >

Re: [PATCH] make TIOCSTI ioctl require CAP_SYS_ADMIN

2017-04-22 Thread Matt Brown
On 04/21/2017 01:24 AM, Serge E. Hallyn wrote: On Fri, Apr 21, 2017 at 01:09:59AM -0400, Matt Brown wrote: On 04/20/2017 01:41 PM, Serge E. Hallyn wrote: Quoting m...@nmatt.com (m...@nmatt.com): On 2017-04-20 11:19, Serge E. Hallyn wrote: Quoting Matt Brown (m...@nmatt.com): On 04/19/2017 07

Re: [PATCH] make TIOCSTI ioctl require CAP_SYS_ADMIN

2017-04-20 Thread Kees Cook
On Thu, Apr 20, 2017 at 10:24 PM, Serge E. Hallyn wrote: > On Fri, Apr 21, 2017 at 01:09:59AM -0400, Matt Brown wrote: >> On 04/20/2017 01:41 PM, Serge E. Hallyn wrote: >> >Quoting m...@nmatt.com (m...@nmatt.com): >> >>On 2017-04-20 11:19, Serge E. Hallyn wrote: >> >>>Quoting Matt Brown (m...@nmat

Re: [PATCH] make TIOCSTI ioctl require CAP_SYS_ADMIN

2017-04-20 Thread Serge E. Hallyn
On Fri, Apr 21, 2017 at 01:09:59AM -0400, Matt Brown wrote: > On 04/20/2017 01:41 PM, Serge E. Hallyn wrote: > >Quoting m...@nmatt.com (m...@nmatt.com): > >>On 2017-04-20 11:19, Serge E. Hallyn wrote: > >>>Quoting Matt Brown (m...@nmatt.com): > On 04/19/2017 07:53 PM, Serge E. Hallyn wrote: > >

Re: [PATCH] make TIOCSTI ioctl require CAP_SYS_ADMIN

2017-04-20 Thread Matt Brown
On 04/20/2017 01:41 PM, Serge E. Hallyn wrote: Quoting m...@nmatt.com (m...@nmatt.com): On 2017-04-20 11:19, Serge E. Hallyn wrote: Quoting Matt Brown (m...@nmatt.com): On 04/19/2017 07:53 PM, Serge E. Hallyn wrote: Quoting Matt Brown (m...@nmatt.com): On 04/19/2017 12:58 AM, Serge E. Hallyn

Re: [PATCH] make TIOCSTI ioctl require CAP_SYS_ADMIN

2017-04-20 Thread Serge E. Hallyn
Quoting m...@nmatt.com (m...@nmatt.com): > On 2017-04-20 11:19, Serge E. Hallyn wrote: > >Quoting Matt Brown (m...@nmatt.com): > >>On 04/19/2017 07:53 PM, Serge E. Hallyn wrote: > >>>Quoting Matt Brown (m...@nmatt.com): > On 04/19/2017 12:58 AM, Serge E. Hallyn wrote: > >On Tue, Apr 18, 201

Re: [PATCH] make TIOCSTI ioctl require CAP_SYS_ADMIN

2017-04-20 Thread matt
On 2017-04-20 11:19, Serge E. Hallyn wrote: Quoting Matt Brown (m...@nmatt.com): On 04/19/2017 07:53 PM, Serge E. Hallyn wrote: >Quoting Matt Brown (m...@nmatt.com): >>On 04/19/2017 12:58 AM, Serge E. Hallyn wrote: >>>On Tue, Apr 18, 2017 at 11:45:26PM -0400, Matt Brown wrote: This patch rep

Re: [kernel-hardening] Re: [PATCH] make TIOCSTI ioctl require CAP_SYS_ADMIN

2017-04-20 Thread Serge E. Hallyn
Quoting Serge E. Hallyn (se...@hallyn.com): > Quoting Matt Brown (m...@nmatt.com): > > On 04/19/2017 07:53 PM, Serge E. Hallyn wrote: > > >Quoting Matt Brown (m...@nmatt.com): > > >>On 04/19/2017 12:58 AM, Serge E. Hallyn wrote: > > >>>On Tue, Apr 18, 2017 at 11:45:26PM -0400, Matt Brown wrote: > >

Re: [PATCH] make TIOCSTI ioctl require CAP_SYS_ADMIN

2017-04-20 Thread Serge E. Hallyn
Quoting Matt Brown (m...@nmatt.com): > On 04/19/2017 07:53 PM, Serge E. Hallyn wrote: > >Quoting Matt Brown (m...@nmatt.com): > >>On 04/19/2017 12:58 AM, Serge E. Hallyn wrote: > >>>On Tue, Apr 18, 2017 at 11:45:26PM -0400, Matt Brown wrote: > This patch reproduces GRKERNSEC_HARDEN_TTY function

Re: [PATCH] make TIOCSTI ioctl require CAP_SYS_ADMIN

2017-04-19 Thread Matt Brown
On 04/19/2017 07:53 PM, Serge E. Hallyn wrote: Quoting Matt Brown (m...@nmatt.com): On 04/19/2017 12:58 AM, Serge E. Hallyn wrote: On Tue, Apr 18, 2017 at 11:45:26PM -0400, Matt Brown wrote: This patch reproduces GRKERNSEC_HARDEN_TTY functionality from the grsecurity project in-kernel. This w

Re: [PATCH] make TIOCSTI ioctl require CAP_SYS_ADMIN

2017-04-19 Thread Matt Brown
On 04/19/2017 07:18 AM, James Morris wrote: On Tue, 18 Apr 2017, Matt Brown wrote: This patch reproduces GRKERNSEC_HARDEN_TTY functionality from the grsecurity project in-kernel. It seems like an ugly hack to an ugly feature (CAP_SYS_ADMIN barely makes sense here), and rather than sprinkling

Re: [PATCH] make TIOCSTI ioctl require CAP_SYS_ADMIN

2017-04-19 Thread Serge E. Hallyn
Quoting Matt Brown (m...@nmatt.com): > On 04/19/2017 12:58 AM, Serge E. Hallyn wrote: > >On Tue, Apr 18, 2017 at 11:45:26PM -0400, Matt Brown wrote: > >>This patch reproduces GRKERNSEC_HARDEN_TTY functionality from the grsecurity > >>project in-kernel. > >> > >>This will create the Kconfig SECURITY

Re: [PATCH] make TIOCSTI ioctl require CAP_SYS_ADMIN

2017-04-19 Thread Matt Brown
On 04/19/2017 01:20 AM, Kees Cook wrote: On Tue, Apr 18, 2017 at 9:58 PM, Serge E. Hallyn wrote: On Tue, Apr 18, 2017 at 11:45:26PM -0400, Matt Brown wrote: This patch reproduces GRKERNSEC_HARDEN_TTY functionality from the grsecurity project in-kernel. This will create the Kconfig SECURITY_TI

Re: [PATCH] make TIOCSTI ioctl require CAP_SYS_ADMIN

2017-04-19 Thread Matt Brown
On 04/19/2017 12:58 AM, Serge E. Hallyn wrote: On Tue, Apr 18, 2017 at 11:45:26PM -0400, Matt Brown wrote: This patch reproduces GRKERNSEC_HARDEN_TTY functionality from the grsecurity project in-kernel. This will create the Kconfig SECURITY_TIOCSTI_RESTRICT and the corresponding sysctl kernel.t

Re: [PATCH] make TIOCSTI ioctl require CAP_SYS_ADMIN

2017-04-19 Thread James Morris
On Tue, 18 Apr 2017, Matt Brown wrote: > This patch reproduces GRKERNSEC_HARDEN_TTY functionality from the grsecurity > project in-kernel. It seems like an ugly hack to an ugly feature (CAP_SYS_ADMIN barely makes sense here), and rather than sprinkling these types of things throughout the kerne

Re: [PATCH] make TIOCSTI ioctl require CAP_SYS_ADMIN

2017-04-18 Thread Kees Cook
On Tue, Apr 18, 2017 at 9:58 PM, Serge E. Hallyn wrote: > On Tue, Apr 18, 2017 at 11:45:26PM -0400, Matt Brown wrote: >> This patch reproduces GRKERNSEC_HARDEN_TTY functionality from the grsecurity >> project in-kernel. >> >> This will create the Kconfig SECURITY_TIOCSTI_RESTRICT and the correspon

Re: [PATCH] make TIOCSTI ioctl require CAP_SYS_ADMIN

2017-04-18 Thread Serge E. Hallyn
On Tue, Apr 18, 2017 at 11:45:26PM -0400, Matt Brown wrote: > This patch reproduces GRKERNSEC_HARDEN_TTY functionality from the grsecurity > project in-kernel. > > This will create the Kconfig SECURITY_TIOCSTI_RESTRICT and the corresponding > sysctl kernel.tiocsti_restrict that, when activated, re

[PATCH] make TIOCSTI ioctl require CAP_SYS_ADMIN

2017-04-18 Thread Matt Brown
This patch reproduces GRKERNSEC_HARDEN_TTY functionality from the grsecurity project in-kernel. This will create the Kconfig SECURITY_TIOCSTI_RESTRICT and the corresponding sysctl kernel.tiocsti_restrict that, when activated, restrict all TIOCSTI ioctl calls from non CAP_SYS_ADMIN users. Possible