The two programs below indirectly call open("/dev/ptmx", O_RDWR). sandbox fails to catch this. #include <pty.h> #include <stdlib.h> #include <stdio.h> #include <unistd.h> int main(void) { int master, slave; if (openpty(&master, &slave, NULL, NULL, NULL)) perror("openpty"); else { close(master); close(slave); } return 0; } #define _GNU_SOURCE 1 #include <stdlib.h> #include <fcntl.h> #include <stdio.h> #include <unistd.h> int main(void) { int fd; fd = posix_openpt(O_RDWR); if (fd < 0) perror("posix_openpt"); else close(fd); return 0; }
I would guess that the forkpty(3) function is probably also missed.
what is the problem ? these funcs are used to create new pseudo ttys which some test harnesses use in order create ptys. if we block that, we block the ability for tests to work. conversely, if we don't block this, i'm not seeing what harm can be done to the system. i guess a malicious package could allocate a crap ton of ptys and try to force resource exhaustion, but that can already be done in many other ways, and we specifically do not market sandbox as a security solution against malicious actors -- it is a tool to prevent/catch accidental bad behavior.
It was just something I noticed due to experimenting in response to bug 550650. If you don't think build processes opening /dev/ptmx is a problem, feel free to close this.
(In reply to Mike Gilbert from comment #3) if someone can think of a case where these funcs mess with existing ptys, then we can revisit, but the act of creating new ptys shouldn't be a problem
(In reply to SpanKY from comment #4) > (In reply to Mike Gilbert from comment #3) > > if someone can think of a case where these funcs mess with existing ptys, > then we can revisit, but the act of creating new ptys shouldn't be a problem It might be worth adding /dev/ptmx to the default SANDBOX_WRITE setting, just for consistencies sake; it is technically valid for a process to obtain a pty by calling open("/dev/ptmx", ...) directly.
(In reply to Mike Gilbert from comment #5) that is true, but i'm not aware of any package ever having tried to do that :)
It seems we've got a usecase now: https://bugs.gentoo.org/show_bug.cgi?id=550650
i've whitelisted write access to /dev/ptmx now: http://gitweb.gentoo.org/proj/sandbox.git/commit/?id=6b9b505f4a7716a50ff9e63c85f2c4882987a732
