Created attachment 268398 [details] Example to add tunable sysctl option to allow or deny TIOCSTI On FreeBSD it is possible to do TTY injection using TIOCSTI when using tools like su(1) and jexec(8). FreeBSD removed support for TIOCSTI briefly but added again in 328d9d2c96e2349acbc2da4efc5ad34d68a47df6. The author thinks this is conceptually bad but is needed for tools like mail(1). There may be other tools and shells that depend on it too. OpenBSD completely removed support for TIOCSTI in 2017. HardenedBSD has a toggle to disable TIOCSTI. The toggle is set to prohibit TIOCSTI by default. I want to propose adding a tunable sysctl(8) option which allows or denies TIOCSTI. A proof of concept is attached. Before the patch, when using jexec(8) to run a jailed command as a normal user, it is possible to inject a command which then runs as the root user on the host: # jexec -U wout 3 /home/wout/inject whoami whoami # whoami root When I enable the new tunable, this is not permitted: # sysctl security.bsd.allow_tiocsti=0 security.bsd.allow_tiocsti: 1 -> 0 # jexec -U wout 3 /home/wout/inject whoami ioctl TIOCSTI failed: Operation not permitted This might be a good candidate to add to usr.sbin/bsdinstall/scripts/hardening as well.
Created attachment 268566 [details] Example to inject strings using TIOCSTI
A commit in branch main references this bug: URL: https://cgit.FreeBSD.org/src/commit/?id=c94b8eee5bcb5f9d116cce9c831933115cfeeb19 commit c94b8eee5bcb5f9d116cce9c831933115cfeeb19 Author: Ed Maste <emaste@FreeBSD.org> AuthorDate: 2026-06-09 18:26:42 +0000 Commit: Ed Maste <emaste@FreeBSD.org> CommitDate: 2026-06-09 18:27:56 +0000 vt: Rename sysctl to security.bsd.allow_tiocsti This is consistent with allow_read_dir and allow_ptrace. PR: 293485 Fixes: c289291a6736 ("tty: Add sysctl knob to globally disable TIOCSTI") Sponsored by: The FreeBSD Foundation sys/kern/tty.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
Thank you Ed!
A commit in branch stable/15 references this bug: URL: https://cgit.FreeBSD.org/src/commit/?id=16532b220c9cbd9fb0365a80a23cc435003e9986 commit 16532b220c9cbd9fb0365a80a23cc435003e9986 Author: Ed Maste <emaste@FreeBSD.org> AuthorDate: 2026-05-25 13:59:40 +0000 Commit: Ed Maste <emaste@FreeBSD.org> CommitDate: 2026-06-14 20:08:29 +0000 tty: Add sysctl knob to globally disable TIOCSTI Reviewed by: markj PR: 293485 Sponsored by: The FreeBSD Foundation Differential Revision: https://reviews.freebsd.org/D57233 (cherry picked from commit c289291a6736c01dd68fb8459ec3801859b0a59a) (cherry picked from commit c94b8eee5bcb5f9d116cce9c831933115cfeeb19) sys/kern/tty.c | 8 ++++++++ 1 file changed, 8 insertions(+)
A commit in branch stable/14 references this bug: URL: https://cgit.FreeBSD.org/src/commit/?id=b5cb2739b8b5d92e435693f290d0b30bd989460a commit b5cb2739b8b5d92e435693f290d0b30bd989460a Author: Ed Maste <emaste@FreeBSD.org> AuthorDate: 2026-05-25 13:59:40 +0000 Commit: Ed Maste <emaste@FreeBSD.org> CommitDate: 2026-06-14 20:09:31 +0000 tty: Add sysctl knob to globally disable TIOCSTI Reviewed by: markj PR: 293485 Sponsored by: The FreeBSD Foundation Differential Revision: https://reviews.freebsd.org/D57233 (cherry picked from commit c289291a6736c01dd68fb8459ec3801859b0a59a) (cherry picked from commit c94b8eee5bcb5f9d116cce9c831933115cfeeb19) (cherry picked from commit 16532b220c9cbd9fb0365a80a23cc435003e9986) sys/kern/tty.c | 8 ++++++++ 1 file changed, 8 insertions(+)
Thank you Wout, and I apologize that I didn't spot your patch before pushing my change.