On Mon, Jun 23, 2025 at 8:39 AM Stephen Smalley stephen.smalley.work@gmail.com wrote:
On Sun, Jun 22, 2025 at 9:41 PM Abhinav Saxena via B4 Relay devnull+xandfury.gmail.com@kernel.org wrote:
From: Abhinav Saxena xandfury@gmail.com
The TIOCSTI ioctl currently only checks the current process's credentials, creating a TOCTOU vulnerability where an unprivileged process can open a TTY fd and pass it to a privileged process via SCM_RIGHTS.
Fix by requiring BOTH the file opener (file->f_cred) AND the current process to have CAP_SYS_ADMIN. This prevents privilege escalation while ensuring legitimate use cases continue to work.
Link: https://github.com/KSPP/linux/issues/156
Signed-off-by: Abhinav Saxena xandfury@gmail.com
security/selinux/hooks.c | 6 ++++++ 1 file changed, 6 insertions(+)
diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c index 595ceb314aeb..a628551873ab 100644 --- a/security/selinux/hooks.c +++ b/security/selinux/hooks.c @@ -3847,6 +3847,12 @@ static int selinux_file_ioctl(struct file *file, unsigned int cmd, CAP_OPT_NONE, true); break;
case TIOCSTI:if (!file_ns_capable(file, &init_user_ns, CAP_SYS_ADMIN) ||!capable(CAP_SYS_ADMIN))error = -EPERM;break;So, aside from what I said previously, this also will break any existing policies currently controlling TIOCSTI via the selinux ioctl checking in the default case, so at the very least, this would need to be gated by a new SELinux policy capability for compatibility purposes. But I'm still unconvinced that this is the right approach.
I want to add my voice to the other comments that adding these capability checks to the SELinux code and not the main TIOCSTI kernel code is not an approach we want to support. Beyond that, as others have already pointed out, I think some additional inspection and testing is needed to ensure that the additional capability checks do not break existing, valid use cases.