pt_chown arbitrary pts access via user namespace

[halfdog]

With Ubuntu Wily and earlier, /usr/lib/pt_chown was used to change ownership of slave pts devices in /dev/pts to the same uid holding the master file descriptor for the slave. This is done using the pt_chown SUID binary, which invokes the ptsname function on the master-fd, thus again performing a TIOCGPTN ioctl to get the slave pts number. Using the result from the ioctl, the pathname of the slave pts is constructed and chown invoked on it, see login/programs/pt_chown.c:

  pty = ptsname (PTY_FILENO);
  if (pty == NULL)
    ...
  /* Get the group ID of the special `tty' group. */
  p = getgrnam (TTY_GROUP);
  gid = p ? p->gr_gid : getgid ();

  /* Set the owner to the real user ID, and the group to that special
     group ID. */
  if (chown (pty, getuid (), gid) < 0)
    return FAIL_EACCES;

  /* Set the permission mode to readable and writable by the owner,
     and writable by the group. */
  if ((st.st_mode & ACCESSPERMS) != (S_IRUSR|S_IWUSR|S_IWGRP)
      && chmod (pty, S_IRUSR|S_IWUSR|S_IWGRP) < 0)
    return FAIL_EACCES;

  return 0;

The logic above is severely flawed, when there can be more than one master/slave pair having the same number and thus same name. But this condition can be easily created by creating an user namespace, mounting devpts with the newinstance option, create master and slave pts pairs until the number overlaps with a target pts outside the namespace on the host, where there is interest to gain ownership and then invoke pt_chown.

See http://www.halfdog.net/Security/2015/PtChownArbitraryPtsAccessViaUserNamespace/ for more information (User: InvitedOnly, Pass: QV4uLdKn, Sharing policy: see attachment).

# lsb_release -rd
Description: Ubuntu 15.10
Release: 15.10
# apt-cache policy libc-bin
libc-bin:
  Installed: 2.21-0ubuntu4
  Candidate: 2.21-0ubuntu4
  Version table:
 *** 2.21-0ubuntu4 0
        500 http://archive.ubuntu.com/ubuntu/ wily/main amd64 Packages
        100 /var/lib/dpkg/status

[Seth Arnold (seth-arnold)]

Thanks Halfdog; this is currently under active discussion elsewhere; the solution for Wily and previous releases is far from obvious.

Foundations team, it'd be fantastic to stop shipping the setuid root /usr/lib/pt_chown executable in Xenial.

Thanks

[Seth Arnold (seth-arnold)]

"20160222: CRD and publication" on http://www.halfdog.net/Security/2015/PtChownArbitraryPtsAccessViaUserNamespace/

Thanks