tty: Prevent untrappable signals from malicious program

Commit 26df6d1 ("tty: Add EXTPROC support for LINEMODE") allows a process which has opened a pty master to send _any_ signal to the process group of the pty slave. Although potentially exploitable by a malicious program running a setuid program on a pty slave, it's unknown if this exploit currently exists. Limit to signals actually used. Cc: Theodore Ts'o <[email protected]> Cc: Howard Chu <[email protected]> Cc: One Thousand Gnomes <[email protected]> Cc: Jiri Slaby <[email protected]> Cc: <[email protected]> # 2.6.36+ Signed-off-by: Peter Hurley <[email protected]> Signed-off-by: Greg Kroah-Hartman <[email protected]>
fastly · Feb 2, 2015 · 37480a0 · 37480a0
1 parent 19e3ae6
commit 37480a0
Showing 1 changed file with 3 additions and 0 deletions.
diff --git a/drivers/tty/pty.c b/drivers/tty/pty.c
@@ -210,6 +210,9 @@ static int pty_signal(struct tty_struct *tty, int sig)
 {
 	struct pid *pgrp;
 
+	if (sig != SIGINT && sig != SIGQUIT && sig != SIGTSTP)
+		return -EINVAL;
+
 	if (tty->link) {
 		pgrp = tty_get_pgrp(tty->link);
 		if (pgrp)