On Tue, Jun 13, 2023 at 12:23:41PM +0200, Greg KH wrote:
On Thu, Jun 08, 2023 at 07:52:54PM +0200, Michal Sekletar wrote:
On Thu, Jun 8, 2023 at 1:51 PM Greg KH gregkh@linuxfoundation.org wrote:
So how are you protecting this from being an information leak like we have had in the past where you could monitor how many characters were being sent to the tty through a proc file? Seems like now you can just monitor any tty node in the system and get the same information, while today you can only do it for the tty devices you have permissions for, right?
Hi Greg,
I am not protecting against it in any way, but proposed changes are only about timestamp updates which still happen in at least 8 seconds intervals so exact timing of read/writes to tty can't be inferred. Frankly, I may have misunderstood something. It would be great if you could mention a bit more details about CVE you had in mind.
Ah, I missed that this is in 8 second increments, nevermind then!
Note, I still can't take this series for the obvious reason in patch 2/2. Please fix.
thanks,
greg k-h