Improper pty permissions - missing mode=0620, gid=5

This fix is coming from Debian bug: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=720122 The reason for the hardcoded gid= and mode= is because of the fix for CVE-2013-2207 which removes pt_chown from glibc and so requires proper write access to devpts. It looks like the "tty" group is guaranteed to be gid=5 on at least all RedHat based and Debian based systems. So this hardcode gid shouldn't be a big problem. If we however support any distro where that's not the case, we'll need to implement an extra lxc.conf option and matching template changes. Signed-off-by: Stéphane Graber <stgraber@ubuntu.com> Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com>

Improper pty permissions - missing mode=0620, gid=5
67e5a20a · Stéphane Graber · Serge Hallyn · c414be25 · 67e5a20a
Commit 67e5a20a authored Oct 15, 2013 by Stéphane Graber Committed by Serge Hallyn Oct 16, 2013
Hide whitespace changes
Inline Side-by-side

Showing with 1 addition and 1 deletion

conf.c src/lxc/conf.c +1 -1

No files found.
--- a/src/lxc/conf.c
+++ b/src/lxc/conf.c
@@ -1427,7 +1427,7 @@ static int setup_pts(int pts)
 	}

 	if (mount("devpts", "/dev/pts", "devpts", MS_MGC_VAL,
-		  "newinstance,ptmxmode=0666")) {
+		  "newinstance,ptmxmode=0666,mode=0620,gid=5")) {
 		SYSERROR("failed to mount a new instance of '/dev/pts'");
 		return -1;
 	}