[kernel-hardening] Re: [PATCH v7 2/2] security: tty: make TIOCSTI ioctl require CAP_SYS_ADMIN

On Fri, Jun 2, 2017 at 1:05 PM, Alan Cox [off-list ref] wrote:

So I'd say it's all the generic tty ioctls except TIOCSTI and TIOCSETD
but it would be good to see what Android is going with and why.

Android limits tty ioctls to the following whitelist:
  TIOCOUTQ
  FIOCLEX
  TCGETS
  TCSETS
  TIOCGWINSZ
  TIOCSWINSZ
  TIOCSCTTY
  TCSETSW
  TCFLSH
  TIOCSPGRP
  TIOCGPGRP

See unpriv_tty_ioctls at
https://android.googlesource.com/platform/system/sepolicy/+/34b4b73729b288b4109b2225c1445eb58393b8cb/public/ioctl_macros#51


-- 
Nick Kralevich | Android Security | nnk at google.com | 650.214.4037
--
To unsubscribe from this list: send the line "unsubscribe linux-security-module" in
the body of a message to majordomo at vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html