Messages in this thread | | | Date | Tue, 27 Jun 2023 19:48:45 -0700 | From | Kees Cook <> | Subject | Re: [PATCH v3 2/2] tty: Allow TIOCSTI to be disabled |
| |
On Sun, Jun 25, 2023 at 05:56:25PM +0200, Samuel Thibault wrote: > > Can we perhaps just introduce a CAP_TIOCSTI that the brltty daemon would > > be able to use? We could even make it only allow TIOCSTI on the linux > > console (tty->ops == con_ops).
Does brltty run with CAP_SYS_ADMIN? That seems a sensible exception to be made.
> *Please* comment on this so we can progress. ATM people are > advising each other to set dev.tty.legacy_tiocsti=1, which is just > counter-productive in terms of security...
So is there really no solution for brltty and TIOCSTI being disabled? What is FreeBSD doing? I imagine it's the same situation there too, though maybe there is just no support?
https://www.mail-archive.com/brltty@brltty.app/msg02892.html
> Really, this a serious regression for the people affected by this.
Can you send a patch adding a CAP_SYS_ADMIN exception?
-Kees
-- Kees Cook
| |