Maybe this isn't a good idea? twitter.com/hackerfantastic/status/1785…...

run0 has already been exploited: twitter.com/hackerfantastic/status/1785…... There will be plenty more where that came from. Yet another terrible idea and terrible implementation from Poettering.

I think it's worth pointing out that all demonstrations of this issue either needs yama to be disabled for `ptrace` to work (this is what reptyr does under the hood), or you need to be part of the parent process to abuse the tty terminal. The other demonstration shows the latter part, but requires you to have a reverse shell in the parent and can't be abused across users. twitter.com/hackerfantastic/status/1786…... Generally, this issue is overblown. Both of these "exploits" works on `su`, `sudo` and probably `doas` because of session caching or because you have access to `ptrace`. I'm not sure what security boundary you are breaking and this seems more like a cheap dig at `systemd` to feed into the decade-old hate train at this point.

I put a bit further thought into this. The claim is that because the pty has user permissions its possible to hijack it, but that really hasn't been true for years which is why the two PoC do things like use reptyr (involves replacing fd's with ptrace [1], needing either a parent relationship or capabilities that aren't default) or running a command like netcat directly from the pty you want to control [2] (essentially ttyjack [3]). If you look at the implementation of TIOCSTI [4], 99% sure this is what the new PoC is doing, you can see why you can't do this across ttys. This goes back ages, even into some 2.6 kernels it seems before I got bored going back kernel versions. I went and tested all this on a Ubuntu 22.04 box, not possible unless there is a new trick to hijack ttys. I tried the TIOCLINUX across ttys physically at the machine and that didn't work either. [1] blog.nelhage.com/2014/08/new-reptyr-fea…... [2] twitter.com/hackerfantastic/status/1786…... [3] github.com/jwilk/ttyjack [4] elixir.bootlin.com/linux/latest/source…...

x.com/hackerfantastic/status/1786485377… gives a 3rd example to explain the problem and suggests a fix. The pty should be chown() to root after a root program is attached.

3rd example, its a pty permission problem as the OP said in his initial post and he suggested a tested fix. x.com/hackerfantastic/status/1786485377…