From patchwork Sun Dec 6 15:00:23 2015 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Aurelien Jarno X-Patchwork-Id: 553136 Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@bilbo.ozlabs.org Received: from sourceware.org (server1.sourceware.org [209.132.180.131]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ozlabs.org (Postfix) with ESMTPS id 35F9E1402A0 for ; Mon, 7 Dec 2015 02:00:44 +1100 (AEDT) Authentication-Results: ozlabs.org; dkim=pass (1024-bit key; secure) header.d=sourceware.org header.i=@sourceware.org header.b=dKs6NgZZ; dkim-atps=neutral DomainKey-Signature: a=rsa-sha1; c=nofws; d=sourceware.org; h=list-id :list-unsubscribe:list-subscribe:list-archive:list-post :list-help:sender:from:to:cc:subject:date:message-id; q=dns; s= default; b=Xm0wjST3Z1zz40UPun2vElfYu3XQ5VYoAnt4ybPbPrUtcREKZldw8 HoqyrV0EPhagSkcpoouCEueCrDgHbPFCay8Vzx03VMeGDJix6UD7fB+0Qen5Pzoo OE8BOT1B0UyDro0npH8tb14RWcQAtIoO8t+F62XRmaKT8WJ9pQtA+8= DKIM-Signature: v=1; a=rsa-sha1; c=relaxed; d=sourceware.org; h=list-id :list-unsubscribe:list-subscribe:list-archive:list-post :list-help:sender:from:to:cc:subject:date:message-id; s=default; bh=1dT1zPUjwacXJw9+d9gKjSzq0Vg=; b=dKs6NgZZbS1+yV5eOqHgHPVajsby qS2Xf5Ce0kRXZPckH7ZyBe1e4PhYEbBwD/7ZEuq5zrtEe23RDae/CHu68bq+XcAz /290hI6zp+01jW/GfTF8/MkIm/RXKsaMzSqLVVpgwMHss8z610wK2V08jZyya/NY 9xyjgJmGjRIViVM= Received: (qmail 5263 invoked by alias); 6 Dec 2015 15:00:34 -0000 Mailing-List: contact libc-alpha-help@sourceware.org; run by ezmlm Precedence: bulk List-Id: List-Unsubscribe: List-Subscribe: List-Archive: List-Post: List-Help: , Sender: libc-alpha-owner@sourceware.org Delivered-To: mailing list libc-alpha@sourceware.org Received: (qmail 5241 invoked by uid 89); 6 Dec 2015 15:00:32 -0000 Authentication-Results: sourceware.org; auth=none X-Virus-Found: No X-Spam-SWARE-Status: No, score=1.0 required=5.0 tests=BAYES_40, KAM_LAZY_DOMAIN_SECURITY, T_RP_MATCHES_RCVD autolearn=no version=3.3.2 X-HELO: hall.aurel32.net From: Aurelien Jarno To: libc-alpha@sourceware.org Cc: Jakub Wilk , Florian Weimer , Adam Conrad , Aurelien Jarno Subject: [PATCH] grantpt: trust the kernel about pty group and permission mode Date: Sun, 6 Dec 2015 16:00:23 +0100 Message-Id: <1449414023-28926-1-git-send-email-aurelien@aurel32.net> According to POSIX the grantpt() function does the following: The grantpt() function shall change the mode and ownership of the slave pseudo-terminal device associated with its master pseudo-terminal counterpart. The fildes argument is a file descriptor that refers to a master pseudo-terminal device. The user ID of the slave shall be set to the real UID of the calling process and the group ID shall be set to an unspecified group ID. The permission mode of the slave pseudo-terminal shall be set to readable and writable by the owner, and writable by the group. Historically the GNU libc has been responsible to setup the permission mode to 0620 and the group to 'tty' usually number 5, using the pt_chown helper, badly known for its security issues. With the creation of the devpts filesytem in the Linux kernel, this responsability has been moved to the Linux kernel. The system is responsible to mount the devpts filesystem in /dev/pts with the options gid=5 and mode=0620. In that case the GNU libc has nothing to do and pt_chown is not need anymore. So far so good. The problem is that by default the devpts filesystem is shared between all mounts, including the mount options. The options used to do the last mount are the ones used by the system, and given the default options are gid=0 and mode=0600, it's common to see systems using these options. It is enough to run a "mount -t devpts devpts /mychroot/dev/pts" to come into this situation, and it's unfortunately wrongly used in a lot of scripts dealing with chroots, or for creating virtual machines images. When this happens the GNU libc tries to fix the group and permission mode of the pty nodes, and given it fails to do so for non-root users, grantpt() almost always fail. It means users are not able to open new terminals. This patch changes grantpt() to not enforce this anymore, while still enforcing minimum security measures to the permission mode. Therefore the responsibility to follow POSIX is now shared at the system level, i.e. kernel + system scripts + GNU libc. It stops trying to change the group, and makes the pty node readable and writable by the owner, and writable by the group only when originally writable and when the group is the tty one. As a result, on a system wrongly mounted with gid=0 and mode=0600, the pty nodes won't be accessible by the tty group, but the grantpt() function will succeed and users will have a working system. The system is not fully POSIX compliant (which might be an admin choice to default to "mesg n" mode), but the GNU libc is not to blame here, as without the pt_chown helper it can't do anything. With this patch there should not be any reason left to build the GNU libc with the --enable-pt_chown configure option on a GNU/Linux system. --- ChangeLog | 6 ++++++ sysdeps/unix/grantpt.c | 22 ++++++++++++++++++++-- 2 files changed, 26 insertions(+), 2 deletions(-) The original idea comes from Jakub Wilk. I was originally a bit skeptical about it, but after thinking a bit more about it, I don't see any security consequences. Review by other eyes would therefore be greatly appreciated. The goal of this patch is to fully get rid of pt_chown, without breaking the user experience. diff --git a/ChangeLog b/ChangeLog index 379ba75..1bc473c 100644 --- a/ChangeLog +++ b/ChangeLog @@ -1,3 +1,9 @@ +2015-12-06 Aurelien Jarno + Jakub Wilk + + * sysdeps/unix/grantpt.c (grantpt): Do not try to change the group + of the device to the tty group when built without pt_chown support. + 2015-12-04 Paul Eggert Fix typo in strncat, wcsncat manual entries diff --git a/sysdeps/unix/grantpt.c b/sysdeps/unix/grantpt.c index c04c85d..33352e3 100644 --- a/sysdeps/unix/grantpt.c +++ b/sysdeps/unix/grantpt.c @@ -155,6 +155,7 @@ grantpt (int fd) } gid_t gid = tty_gid == -1 ? __getgid () : tty_gid; +#if HAVE_PT_CHOWN /* Make sure the group of the device is that special group. */ if (st.st_gid != gid) { @@ -164,9 +165,26 @@ grantpt (int fd) /* Make sure the permission mode is set to readable and writable by the owner, and writable by the group. */ - if ((st.st_mode & ACCESSPERMS) != (S_IRUSR|S_IWUSR|S_IWGRP)) + mode_t mode = S_IRUSR|S_IWUSR|S_IWGRP; +#else + /* When built without pt_chown, we have delegated the creation of the + node with the right group and permission mode to the kernel, and + non-root users are unlikely to be able to change it. + Therefore let's consider that POSIX enforcement is the responsability + of the whole system and not only the GNU libc and accept different + group or permission mode. */ + + /* Make sure the permission is set to readable and writable by the + owner. For security reason, make it writable by the group only + when originally writable and when the group of the device is that + special group. */ + mode_t mode = S_IRUSR|S_IWUSR| + ((st.st_gid == gid) ? (st.st_mode & S_IWGRP) : 0); +#endif + + if ((st.st_mode & ACCESSPERMS) != mode) { - if (__chmod (buf, S_IRUSR|S_IWUSR|S_IWGRP) < 0) + if (__chmod (buf, mode) < 0) goto helper; }