Re: [vserver] Security issue: guest to host escape via TIOCSTI ioctl in vserver enter

From: halfdog <me_at_halfdog.net>
Date: Sat 10 Nov 2012 - 19:50:58 GMT
Message-ID: <509EB022.3010507@halfdog.net>

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Herbert Poetzl wrote:
> On Sat, Nov 10, 2012 at 03:49:21PM +0000, halfdog wrote: Herbert
> Poetzl wrote: ..
>> I have not found any other ways to manipulate ttys
> using TIOCSTI or other methods, nor within or between guests.
>>
> good, so I can assume that we are safe in regards to TIOCSTI but
> I'll think about disabling it in general or per guest for the next
> release to make it even safer ...

In the meantime I continued searching for workarounds and best
practice and perhaps the issue could be fixed without disabling this
functionality completely:

You might want to take a look at the "screen" package, from my
understanding it should block tty data injection attacks. Perhaps
vserver enter could be made a wrapper around screen+context-switch or
the sub-pty handling code could be included in vserver tools also.

hd

- --
http://www.halfdog.net/
PGP: 156A AE98 B91F 0114 FE88 2BD8 C459 9386 feed a bee
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.11 (GNU/Linux)

iEYEARECAAYFAlCerHkACgkQxFmThv7tq+7Q7gCfbFDYt2JffOlL6wHCnii/kA87
FYEAnisS85bF3i2zVxH8IvkhaRcJna8M
=rTTo
-----END PGP SIGNATURE-----
Received on Sat Nov 10 19:51:32 2012

[Next/Previous Months] [Main vserver Project Homepage] [Howto Subscribe/Unsubscribe] [Paul Sladen's vserver stuff]
Generated on Sat 10 Nov 2012 - 19:51:32 GMT by hypermail 2.1.8