[RFC PATCH 1/2] tty: mediate TIOCSIG through task_kill LSM hooks
From: Christopher Lusk <hidden>
Date: 2026-09-13 22:20:13
Also in:
linux-kselftest, linux-serial, lkml
Subsystem:
the rest, tty layer and serial drivers · Maintainers:
Linus Torvalds, Greg Kroah-Hartman, Jiri Slaby
TIOCSIG lets a PTY master holder send SIGINT, SIGQUIT, or SIGTSTP to
the slave's foreground process group. pty_signal() currently uses
kill_pgrp(..., priv=1), which represents the signal as SEND_SIG_PRIV.
check_kill_permission() consequently returns before security_task_kill().
This leaves the operation outside every task_kill LSM policy. In
particular, a task restricted with LANDLOCK_SCOPE_SIGNAL can use a
retained PTY master to signal an out-of-domain foreground process group.
Add a kill_pgrp_lsm() variant selected only by pty_signal(). It invokes
security_task_kill() for each process-group member immediately before
delivery while tasklist_lock remains held. This preserves the existing
per-recipient and partial-success semantics without a separate pre-check
race. Ordinary privileged process-group signals continue to use the
unchanged kill_pgrp() path.
This is an RFC because the policy boundary is not settled. Landlock's
IOCTL documentation warns that pre-existing TTY file descriptors remain
dangerous, while LANDLOCK_SCOPE_SIGNAL separately promises to restrict
signals to processes outside the domain hierarchy. The proposed helper
also makes SELinux, Smack, AppArmor, and other task_kill LSMs mediate
TIOCSIG for the first time. Maintainer guidance is requested on whether
this should instead use a dedicated, opt-in TTY signal hook.
Tested on x86-64 QEMU with a held-constant four-cell effect oracle.
Across three boots per image, the unpatched kernel
delivered 96/96 cross-domain scoped TIOCSIG attempts; the patched kernel
denied 96/96. Both images delivered 96/96 unconfined and 96/96
same-domain TIOCSIG controls, and denied 96/96 scoped direct-kill
anchors. There were no indeterminate cases or kernel diagnostics.
Fixes: 54a6e6bbf3be ("landlock: Add signal scoping")
Link: https://lore.kernel.org/r/56bffc24f3d0d08b45a686a48e99766b0a0821fa.1780614610.git.hexlabsecurity@proton.me (local)
Assisted-by: Claude:claude-opus-4-8
Assisted-by: Codex:gpt-5.6-sol
Signed-off-by: Christopher Lusk <redacted>
---
drivers/tty/pty.c | 8 ++++++--
include/linux/sched/signal.h | 1 +
kernel/signal.c | 30 ++++++++++++++++++++++++++++--
3 files changed, 35 insertions(+), 4 deletions(-)
diff --git a/drivers/tty/pty.c b/drivers/tty/pty.c
index cc7f7091ed9a..8f5eea156ce4 100644
--- a/drivers/tty/pty.c
+++ b/drivers/tty/pty.c@@ -187,6 +187,7 @@ static int pty_get_pktmode(struct tty_struct *tty, int __user *arg) /* Send a signal to the slave */ static int pty_signal(struct tty_struct *tty, int sig) { + int ret = 0; struct pid *pgrp; if (sig != SIGINT && sig != SIGQUIT && sig != SIGTSTP)
@@ -195,10 +196,13 @@ static int pty_signal(struct tty_struct *tty, int sig) if (tty->link) { pgrp = tty_get_pgrp(tty->link); if (pgrp) - kill_pgrp(pgrp, sig, 1); + ret = kill_pgrp_lsm(pgrp, sig, 1); put_pid(pgrp); } - return 0; + /* Preserve the historical success result for an empty process group. */ + if (ret == -ESRCH) + return 0; + return ret; } static void pty_flush_buffer(struct tty_struct *tty)
diff --git a/include/linux/sched/signal.h b/include/linux/sched/signal.h
index 584ae88b435e..7d6aee7256a3 100644
--- a/include/linux/sched/signal.h
+++ b/include/linux/sched/signal.h@@ -337,6 +337,7 @@ extern int kill_pid_info(int sig, struct kernel_siginfo *info, struct pid *pid); extern int kill_pid_usb_asyncio(int sig, int errno, sigval_t addr, struct pid *, const struct cred *); extern int kill_pgrp(struct pid *pid, int sig, int priv); +int kill_pgrp_lsm(struct pid *pid, int sig, int priv); extern int kill_pid(struct pid *pid, int sig, int priv); extern __must_check bool do_notify_parent(struct task_struct *, int); extern void __wake_up_parent(struct task_struct *p, struct task_struct *parent);
diff --git a/kernel/signal.c b/kernel/signal.c
index a5e15bf09d31..758393b7257d 100644
--- a/kernel/signal.c
+++ b/kernel/signal.c@@ -1426,13 +1426,22 @@ int group_send_sig_info(int sig, struct kernel_siginfo *info, * control characters do (^C, ^Z etc) * - the caller must hold at least a readlock on tasklist_lock */ -int __kill_pgrp_info(int sig, struct kernel_siginfo *info, struct pid *pgrp) +static int __kill_pgrp_info_filtered(int sig, struct kernel_siginfo *info, + struct pid *pgrp, bool check_lsm) { struct task_struct *p = NULL; int ret = -ESRCH; do_each_pid_task(pgrp, PIDTYPE_PGID, p) { - int err = group_send_sig_info(sig, info, p, PIDTYPE_PGID); + int err = 0; + + if (check_lsm) { + rcu_read_lock(); + err = security_task_kill(p, info, sig, NULL); + rcu_read_unlock(); + } + if (!err) + err = group_send_sig_info(sig, info, p, PIDTYPE_PGID); /* * If group_send_sig_info() succeeds at least once ret * becomes 0 and after that the code below has no effect.
@@ -1446,6 +1455,11 @@ int __kill_pgrp_info(int sig, struct kernel_siginfo *info, struct pid *pgrp) return ret; } +int __kill_pgrp_info(int sig, struct kernel_siginfo *info, struct pid *pgrp) +{ + return __kill_pgrp_info_filtered(sig, info, pgrp, false); +} + static int kill_pid_info_type(int sig, struct kernel_siginfo *info, struct pid *pid, enum pid_type type) {
@@ -1886,6 +1900,18 @@ int kill_pgrp(struct pid *pid, int sig, int priv) } EXPORT_SYMBOL(kill_pgrp); +int kill_pgrp_lsm(struct pid *pid, int sig, int priv) +{ + int ret; + + read_lock(&tasklist_lock); + ret = __kill_pgrp_info_filtered(sig, __si_special(priv), pid, true); + read_unlock(&tasklist_lock); + + return ret; +} +EXPORT_SYMBOL_GPL(kill_pgrp_lsm); + int kill_pid(struct pid *pid, int sig, int priv) { return kill_pid_info(sig, __si_special(priv), pid);
--
2.55.0