tty[1-6] is now root:tty 0660 instead of root:root 0600

[Jamie Strandboge]

As of precise (2.20.1-1ubuntu3 to be exact), /dev/tty[1-6] now has the following permissions:
$ ls -l /dev/tty[1-6]
crw-rw---- 1 root tty 4, 1 Apr 12 13:06 /dev/tty1
crw-rw---- 1 root tty 4, 2 Apr 12 13:06 /dev/tty2
crw-rw---- 1 root tty 4, 3 Apr 12 13:06 /dev/tty3
crw-rw---- 1 root tty 4, 4 Apr 12 13:06 /dev/tty4
crw-rw---- 1 root tty 4, 5 Apr 12 13:06 /dev/tty5
crw-rw---- 1 root tty 4, 6 Apr 12 13:06 /dev/tty6

In 11.10 and earlier (I checked back to hardy), the permissions were:
$ ls -l /dev/tty[1-6]
crw------- 1 root root 4, 1 2012-03-25 09:18 /dev/tty1
crw------- 1 root root 4, 2 2012-03-25 09:17 /dev/tty2
crw------- 1 root root 4, 3 2012-03-25 09:17 /dev/tty3
crw------- 1 root root 4, 4 2012-03-25 09:17 /dev/tty4
crw------- 1 root root 4, 5 2012-03-25 09:17 /dev/tty5
crw------- 1 root root 4, 6 2012-03-25 09:17 /dev/tty6

This appears to be because of this util-linux commit:
http://git.kernel.org/?p=utils/util-linux/util-linux.git;a=commit;h=3aa6b68f7e19fa3e1c2bba75bee921a98b7b46af

I'm not sure if this is a problem, but it isn't clear why the change was made and I'm having a hard time knowing why the group was changed. This is the bit of code that I think is the cause:
+ /*
+ * There is always a race between this reset and the call to
+ * vhangup() that s.o. can use to get access to your tty.
+ * Linux login(1) will change tty permissions. Use root owner and group
+ * with permission -rw------- for the period between getty and login.
+ */
+ if (chown (buf, 0, gid) || chmod (buf, (gid ? 0660 : 0600))) {
+ if (errno == EROFS)
+ log_warn("%s: %m", buf);
+ else
+ log_err("%s: %m", buf);
+ }

There might not be anything to do with this, but I am filing it to get other's opinions.

[Adam Conrad (adconrad)]

This is actually the code responsible:

@@ -686,12 +770,16 @@ static void open_tty(char *tty, struct termios *tp, struct options *op)
                log_err("%s: tcgetattr: %m", tty);

        /*
- * Linux login(1) will change tty permissions. Use root owner and group
- * with permission -rw------- for the period between getty and login.
+ * Detect if this is a virtual console or serial/modem line.
+ * In case of a virtual console the ioctl TIOCMGET fails and
+ * the error number will be set to EINVAL.
         */
- ignore_result(chown(tty, 0, 0));
- ignore_result(chmod(tty, 0600));
- errno = 0;
+ if (ioctl(STDIN_FILENO, TIOCMGET, &serial) < 0 && (errno = EINVAL)) {
+ op->flags |= F_VCONSOLE;
+ if (!op->term)
+ op->term = DEFAULT_VCTERM;
+ } else if (!op->term)
+ op->term = DEFAULT_STERM;

        setenv("TERM", op->term, 1);
 }

[Jamie Strandboge (jdstrand)]

Adam Conrad points out that all the other /dev/tty[0-9]* have group tty ownership. However, they are 0620:
$ ls -l /dev/tty10
crw--w---- 1 root tty 4, 10 Apr 13 09:29 /dev/tty10

This is presumably from the udev default in /lib/udev/rules.d/50-udev-default.rules:
KERNEL=="tty[0-9]*", GROUP="tty", MODE="0620"

[Adam Conrad (adconrad)]

08:36 < infinity> Right, the code you hilighted is making them 660.
08:36 < infinity> The code I hilighted (or the removal) is making them remain root:tty.
08:37 < infinity> If there's a valid argument for the udev rule being 620, we could make util-linux mirror that.

[Jamie Strandboge (jdstrand)]

So, while don't have a strong opinion on if group read is a problem, it seems that if getty is going to allow looser permissions than the default udev rule, (ie adding group read), it should be an active decision to solve a real problem. Before the permissions were more strict, so from a security point of view, it wasn't a problem. Perhaps we should adjust util-linux to use 0620 to mimic the udev rule?

[Jamie Strandboge (jdstrand)]

I forgot to mention that this is where udev introduced the change from 0666 to 0620:
http://<email address hidden>/msg09416.html

and this is where 0620 was mentioned in Debian (but for makedev, not udev):
http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=244751/0620#42

[Jamie Strandboge (jdstrand)]

Maybe it is weak google-fu, but I can't find any justification for why util-linux chose 0660. My gut feeling is they chose it because it seemed reasonable for them at the time, but that doesn't mean it is reasonable for us and I would encourage us to consider using the udev default of 0620.

[Phillip Susi (psusi)]

This has been fixed upstream in release 2.23.