kernel/linux.git/drivers/tty/vt/selection.c, branch v6.12.80

tty: Require CAP_SYS_ADMIN for all usages of TIOCL_SELMOUSEREPORT

2025-05-02T05:59:10+00:00

commit ee6a44da3c87cf64d67dd02be8c0127a5bf56175 upstream. This requirement was overeagerly loosened in commit 2f83e38a095f ("tty: Permit some TIOCL_SETSEL modes without CAP_SYS_ADMIN"), but as it turns out, (1) the logic I implemented there was inconsistent (apologies!), (2) TIOCL_SELMOUSEREPORT might actually be a small security risk after all, and (3) TIOCL_SELMOUSEREPORT is only meant to be used by the mouse daemon (GPM or Consolation), which runs as CAP_SYS_ADMIN already. In more detail: 1. The previous patch has inconsistent logic: In commit 2f83e38a095f ("tty: Permit some TIOCL_SETSEL modes without CAP_SYS_ADMIN"), we checked for sel_mode == TIOCL_SELMOUSEREPORT, but overlooked that the lower four bits of this "mode" parameter were actually used as an additional way to pass an argument. So the patch did actually still require CAP_SYS_ADMIN, if any of the mouse button bits are set, but did not require it if none of the mouse buttons bits are set. This logic is inconsistent and was not intentional. We should have the same policies for using TIOCL_SELMOUSEREPORT independent of the value of the "hidden" mouse button argument. I sent a separate documentation patch to the man page list with more details on TIOCL_SELMOUSEREPORT: https://lore.kernel.org/all/20250223091342.35523-2-gnoack3000@gmail.com/ 2. TIOCL_SELMOUSEREPORT is indeed a potential security risk which can let an attacker simulate "keyboard" input to command line applications on the same terminal, like TIOCSTI and some other TIOCLINUX "selection mode" IOCTLs. By enabling mouse reporting on a terminal and then injecting mouse reports through TIOCL_SELMOUSEREPORT, an attacker can simulate mouse movements on the same terminal, similar to the TIOCSTI keystroke injection attacks that were previously possible with TIOCSTI and other TIOCL_SETSEL selection modes. Many programs (including libreadline/bash) are then prone to misinterpret these mouse reports as normal keyboard input because they do not expect input in the X11 mouse protocol form. The attacker does not have complete control over the escape sequence, but they can at least control the values of two consecutive bytes in the binary mouse reporting escape sequence. I went into more detail on that in the discussion at https://lore.kernel.org/all/20250221.0a947528d8f3@gnoack.org/ It is not equally trivial to simulate arbitrary keystrokes as it was with TIOCSTI (commit 83efeeeb3d04 ("tty: Allow TIOCSTI to be disabled")), but the general mechanism is there, and together with the small number of existing legit use cases (see below), it would be better to revert back to requiring CAP_SYS_ADMIN for TIOCL_SELMOUSEREPORT, as it was already the case before commit 2f83e38a095f ("tty: Permit some TIOCL_SETSEL modes without CAP_SYS_ADMIN"). 3. TIOCL_SELMOUSEREPORT is only used by the mouse daemons (GPM or Consolation), and they are the only legit use case: To quote console_codes(4): The mouse tracking facility is intended to return xterm(1)-compatible mouse status reports. Because the console driver has no way to know the device or type of the mouse, these reports are returned in the console input stream only when the virtual terminal driver receives a mouse update ioctl. These ioctls must be generated by a mouse-aware user-mode application such as the gpm(8) daemon. Jared Finder has also confirmed in https://lore.kernel.org/all/491f3df9de6593df8e70dbe77614b026@finder.org/ that Emacs does not call TIOCL_SELMOUSEREPORT directly, and it would be difficult to find good reasons for doing that, given that it would interfere with the reports that GPM is sending. More information on the interaction between GPM, terminals and the kernel with additional pointers is also available in this patch: https://lore.kernel.org/all/a773e48920aa104a65073671effbdee665c105fc.1603963593.git.tammo.block@gmail.com/ For background on who else uses TIOCL_SELMOUSEREPORT: Debian Code search finds one page of results, the only two known callers are the two mouse daemons GPM and Consolation. (GPM does not show up in the search results because it uses literal numbers to refer to TIOCLINUX-related enums. I looked through GPM by hand instead. TIOCL_SELMOUSEREPORT is also not used from libgpm.) https://codesearch.debian.net/search?q=TIOCL_SELMOUSEREPORT Cc: Jared Finder Cc: Jann Horn Cc: Hanno Böck Cc: Jiri Slaby Cc: Kees Cook Cc: stable Fixes: 2f83e38a095f ("tty: Permit some TIOCL_SETSEL modes without CAP_SYS_ADMIN") Signed-off-by: Günther Noack Link: https://lore.kernel.org/r/20250411070144.3959-2-gnoack3000@gmail.com Signed-off-by: Greg Kroah-Hartman

tty: Permit some TIOCL_SETSEL modes without CAP_SYS_ADMIN

2025-02-17T09:04:57+00:00

commit 2f83e38a095f8bf7c6029883d894668b03b9bd93 upstream. With this, processes without CAP_SYS_ADMIN are able to use TIOCLINUX with subcode TIOCL_SETSEL, in the selection modes TIOCL_SETPOINTER, TIOCL_SELCLEAR and TIOCL_SELMOUSEREPORT. TIOCL_SETSEL was previously changed to require CAP_SYS_ADMIN, as this IOCTL let callers change the selection buffer and could be used to simulate keypresses. These three TIOCL_SETSEL selection modes, however, are safe to use, as they do not modify the selection buffer. This fixes a mouse support regression that affected Emacs (invisible mouse cursor). Cc: stable Link: https://lore.kernel.org/r/ee3ec63269b43b34e1c90dd8c9743bf8@finder.org Fixes: 8d1b43f6a6df ("tty: Restrict access to TIOCLINUX' copy-and-paste subcommands") Signed-off-by: Günther Noack Reviewed-by: Kees Cook Link: https://lore.kernel.org/r/20250110142122.1013222-1-gnoack@google.com Signed-off-by: Greg Kroah-Hartman

tty: vt: fix up kernel-doc

2024-01-28T02:08:55+00:00

selection.c and vt.c still uses tabs in the kernel-doc. This misrenders the functions in the output -- sphinx misinterprets the description. So remove these tabs, incl. those around dashes. 'enum' keyword is needed before enum names. Fix that. Superfluous \n after the comments are also removed. They are not completely faulty, but this unifies all the kernel-doc in the files. Finally fix up the cross references. Signed-off-by: "Jiri Slaby (SUSE)" Reviewed-by: Randy Dunlap Tested-by: Helge Deller # parisc STI console Link: https://lore.kernel.org/r/20240122110401.7289-47-jirislaby@kernel.org Signed-off-by: Greg Kroah-Hartman

tty: vt: make vc_is_sel()'s vc const

2024-01-28T02:08:52+00:00

It's only an aid to people reading the header and/or calling vc_is_sel(). vc is only tested there, so having it const makes sense. Signed-off-by: "Jiri Slaby (SUSE)" Tested-by: Helge Deller # parisc STI console Link: https://lore.kernel.org/r/20240122110401.7289-9-jirislaby@kernel.org Signed-off-by: Greg Kroah-Hartman

tty: vt: push console lock from tioclinux() down to 2 functions

2024-01-28T02:08:52+00:00

Avoid costly user copies under the console lock. So push the lock down from tioclinux() to sel_loadlut() and set_vesa_blanking(). It is now obvious what is actually protected. Signed-off-by: "Jiri Slaby (SUSE)" Tested-by: Helge Deller # parisc STI console Link: https://lore.kernel.org/r/20240122110401.7289-7-jirislaby@kernel.org Signed-off-by: Greg Kroah-Hartman

tty: vt: pass proper pointers from tioclinux()

2024-01-28T02:08:52+00:00

Pass proper types and proper pointers (the data with an offset) to the TIOCL_* handlers. So that they need not to cast or add anything to the passed pointer. This makes obvious what is passed/consumed. Signed-off-by: "Jiri Slaby (SUSE)" Tested-by: Helge Deller # parisc STI console Link: https://lore.kernel.org/r/20240122110401.7289-6-jirislaby@kernel.org Signed-off-by: Greg Kroah-Hartman

tty: switch count in tty_ldisc_receive_buf() to size_t

2023-08-11T19:12:45+00:00

It comes from both paste_selection() and tty_port_default_receive_buf() as unsigned (int and size_t respectively). Switch to size_t to converge to that eventually. Return the count as size_t too (the two callers above expect that). Switch paste_selection()'s type of 'count' too, so that the returned and passed type match. Signed-off-by: "Jiri Slaby (SUSE)" Link: https://lore.kernel.org/r/20230810091510.13006-13-jirislaby@kernel.org Signed-off-by: Greg Kroah-Hartman

tty/vt: consolemap: make parameters of inverse_translate() saner

2022-06-10T11:37:01+00:00

- int use_unicode -> bool: it's used as bool at some places already, so make it explicit. - int glyph -> u16: every caller passes a u16 in. So make it explicit too. And remove a negative check from inverse_translate() as it never could be negative. Reviewed-by: Ilpo Järvinen Signed-off-by: Jiri Slaby Link: https://lore.kernel.org/r/20220607104946.18710-7-jslaby@suse.cz Signed-off-by: Greg Kroah-Hartman

tty: vt: selection: Correct misspelled function sel_loadlut()

2021-05-20T15:05:33+00:00

Fixes the following W=1 kernel build warning(s): drivers/tty/vt/selection.c:119: warning: expecting prototype for set loadlut(). Prototype was for sel_loadlut() instead Cc: Greg Kroah-Hartman Cc: Jiri Slaby Signed-off-by: Lee Jones Link: https://lore.kernel.org/r/20210520121906.3468725-2-lee.jones@linaro.org Signed-off-by: Greg Kroah-Hartman

vt: Move custom isspace() to its own namespace

2021-05-13T18:38:51+00:00

If by some reason any of the headers will include ctype.h we will have a name collision. Avoid this by moving isspace() to the dedicate namespace. First appearance of the code is in the commit 24a1c2a769cf ("Import 1.1.92"). Reported-by: kernel test robot Reviewed-by: Jiri Slaby Signed-off-by: Andy Shevchenko Link: https://lore.kernel.org/r/20210510144947.58270-1-andriy.shevchenko@linux.intel.com Signed-off-by: Greg Kroah-Hartman