bug#24541: runcon tty hijacking via TIOCSTI ioctl

[up201407890]

Quoting "Paul Eggert" <address@hidden>:

Hello,

I set the bug report here before I got a response from Paul Moore
https://marc.info/?l=selinux&m=147481004710264&w=2

"I don't think we need to fix this for runcon, as it isn't as
sandboxing tool like sandbox, and the loss of job control would likely
be much more noticeable for runcon."


> address@hidden wrote re <http://bugs.gnu.org/24541>:
> > When executing a program via the runcon utility, the nonpriv session
> > can escape to the parent session by using the TIOCSTI ioctl to push
> > characters into the terminal's input buffer, allowing an attacker to
> > execute arbitrary commands without the SELinux security context.
>
> Thanks for the bug report. Surely this is a bug in the setexeccon  
> system call, not in the runcon command that uses the system call.  
> That being said, perhaps runcon should work around the bug via  
> something like the attached patch.



----------------------------------------------------------------
This message was sent using IMP, the Internet Messaging Program.