Re: [PATCH v3 2/2] tiocsti-restrict : make TIOCSTI ioctl require CAP_SYS_ADMIN

2017-04-23 Thread Serge E. Hallyn
Quoting Matt Brown (m...@nmatt.com): > This introduces the tiocsti_restrict sysctl, whose default is controlled via > CONFIG_SECURITY_TIOCSTI_RESTRICT. When activated, this control restricts > all TIOCSTI ioctl calls from non CAP_SYS_ADMIN users. > > This patch was inspired from GRKERNSEC_HARDEN_T

[PATCH v3 2/2] tiocsti-restrict : make TIOCSTI ioctl require CAP_SYS_ADMIN

2017-04-23 Thread Matt Brown
This introduces the tiocsti_restrict sysctl, whose default is controlled via CONFIG_SECURITY_TIOCSTI_RESTRICT. When activated, this control restricts all TIOCSTI ioctl calls from non CAP_SYS_ADMIN users. This patch was inspired from GRKERNSEC_HARDEN_TTY. This patch would have prevented https://bu