From d2ad8ae5c56330f46fe891346025e1e0164372e3 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?P=C3=A1draig=20Brady?=
Date: Mon, 28 Aug 2017 01:57:54 -0700 Subject: [PATCH] runcon: disable use of the TIOCSTI ioctl Similar to the issue with SELinux sandbox (CVE-2016-7545), children of runcon can inject arbitrary input to the terminal that would be run at the originating terminal privileges. The new libseccomp dependency is widely available and used on modern SELinux systems, but is not available by default on older systems like RHEL6 etc. * m4/jm-macros.m4: Check for libseccomp and warn if unavailable on selinux supporting systems. * src/local.mk: Link runcon with -lseccomp. * src/runcon.c (disable_tty_inject): A new function to disable use of the TIOCSTI using libseccomp, or with setsid() where libseccomp is unavailable. * tests/misc/runcon-no-inject.sh: A new test that uses python to make the TIOCSTI call, and ensure that doesn't succeed. * tests/local.mk: Reference the new test * NEWS: Mention the fix. Addresses http://bugs.gnu.org/24541 --- NEWS | 4 ++++ m4/jm-macros.m4 | 13 +++++++++++++ src/local.mk | 1 + src/runcon.c | 28 ++++++++++++++++++++++++++++ tests/local.mk | 1 + tests/misc/runcon-no-inject.sh | 31 +++++++++++++++++++++++++++++++ 6 files changed, 78 insertions(+) create mode 100755 tests/misc/runcon-no-inject.sh diff --git a/NEWS b/NEWS index d37195e..0c744a8 100644 --- a/NEWS +++ b/NEWS @@ -68,6 +68,10 @@ GNU coreutils NEWS -*- outline -*- non regular files are specified, as inotify is ineffective with these. [bug introduced with inotify support added in coreutils-7.5] + runcon now disables use of the TIOCSTI ioctl in its children, which could + be used to inject commands to the terminal and run at the original context. + [the bug dates back to the initial implementation] + uptime no longer outputs the AM/PM component of the current time, as that's inconsistent with the 24 hour time format used. [bug introduced in coreutils-7.0] diff --git a/m4/jm-macros.m4 b/m4/jm-macros.m4 index ef915bd..de0657b 100644 --- a/m4/jm-macros.m4 +++ b/m4/jm-macros.m4 @@ -63,6 +63,19 @@ AC_DEFUN([coreutils_MACROS], esac fi ]) + + # Used by runcon.c + LIB_SECCOMP= + AC_SUBST([LIB_SECCOMP]) + if test "$with_selinux" != no; then + AC_SEARCH_LIBS([seccomp_init], [seccomp], + [test "$ac_cv_search_seccomp_init" = "none required" || + LIB_SECCOMP=$ac_cv_search_seccomp_init + AC_DEFINE([HAVE_SECCOMP], [1], [libseccomp usability])], + [test "$ac_cv_header_selinux_selinux_h" = yes && + AC_MSG_WARN([libseccomp library was not found or not usable]) + AC_MSG_WARN([runcon will be vulnerable to tty injection])]) + fi LIBS=$coreutils_saved_libs # Used by sort.c. diff --git a/src/local.mk b/src/local.mk index 1cb6859..9275b1f 100644 --- a/src/local.mk +++ b/src/local.mk @@ -243,6 +243,7 @@ src_mkfifo_LDADD += $(LIB_SMACK) src_mknod_LDADD += $(LIB_SELINUX) src_mknod_LDADD += $(LIB_SMACK) src_runcon_LDADD += $(LIB_SELINUX) +src_runcon_LDADD += $(LIB_SECCOMP) src_stat_LDADD += $(LIB_SELINUX) # for nvlist_lookup_uint64_array diff --git a/src/runcon.c b/src/runcon.c index 92f519d..611b788 100644 --- a/src/runcon.c +++ b/src/runcon.c @@ -45,6 +45,10 @@ #include