[PATCH] pps: require CAP_SYS_TIME to attach N_PPS ldisc

[PATCH] pps: require CAP_SYS_TIME to attach N_PPS ldisc

[Hungyu Lin]

Any unprivileged user can attach the N_PPS ldisc to a pty, and every
attach registers a PPS source. At most PPS_MAX_SOURCES (256) sources can
exist, so such a user can take all of them, after which registering a
real PPS source fails with -EBUSY.

Require CAP_SYS_TIME to attach N_PPS, the capability that PPS_SETPARAMS
already needs to configure a source.

Fixes: a0880df0ccde ("pps: serial clients support")
Cc: stable@vger.kernel.org
Signed-off-by: Hungyu Lin <dennylin0707@gmail.com>
---
 drivers/pps/clients/pps-ldisc.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/pps/clients/pps-ldisc.c b/drivers/pps/clients/pps-ldisc.c
index fa5660f3c4b7..54678f20edd5 100644
--- a/drivers/pps/clients/pps-ldisc.c
+++ b/drivers/pps/clients/pps-ldisc.c
@@ -46,6 +46,9 @@ static int pps_tty_open(struct tty_struct *tty)
 	struct pps_device *pps;
 	int ret;

+	if (!capable(CAP_SYS_TIME))
+		return -EPERM;
+
 	info.owner = THIS_MODULE;
 	info.dev = NULL;
 	snprintf(info.name, PPS_MAX_NAME_LEN, "%s%d", drv->driver_name, index);
--
2.43.0

Re: [PATCH] pps: require CAP_SYS_TIME to attach N_PPS ldisc

[Rodolfo Giometti]

On 07/11/2026 22:17, Hungyu Lin wrote:
> Any unprivileged user can attach the N_PPS ldisc to a pty, and every
> attach registers a PPS source. At most PPS_MAX_SOURCES (256) sources can
> exist, so such a user can take all of them, after which registering a
> real PPS source fails with -EBUSY.
> 
> Require CAP_SYS_TIME to attach N_PPS, the capability that PPS_SETPARAMS
> already needs to configure a source.
> 
> Fixes: a0880df0ccde ("pps: serial clients support")
> Cc: stable@vger.kernel.org

Are you sure this is stable material? It changes what a user without
CAP_SYS_TIME can do, also on kernels already in the field.

> Signed-off-by: Hungyu Lin <dennylin0707@gmail.com>
> ---
>  drivers/pps/clients/pps-ldisc.c | 3 +++
>  1 file changed, 3 insertions(+)
> 
> diff --git a/drivers/pps/clients/pps-ldisc.c b/drivers/pps/clients/pps-ldisc.c
> index fa5660f3c4b7..54678f20edd5 100644
> --- a/drivers/pps/clients/pps-ldisc.c
> +++ b/drivers/pps/clients/pps-ldisc.c
> @@ -46,6 +46,9 @@ static int pps_tty_open(struct tty_struct *tty)
>  	struct pps_device *pps;
>  	int ret;
> 
> +	if (!capable(CAP_SYS_TIME))
> +		return -EPERM;
> +

Did you check whether this breaks existing setups? Today whoever can
open the serial port can attach N_PPS (e.g. ldattach run by a user in
the dialout group), and with this change they get -EPERM.

Also, is pps_tty_open() called only from TIOCSETD? If it can also be
called when the tty is reopened after a hangup (tty_reopen()?), the
check would be done against whoever reopens the tty, not against
whoever attached N_PPS. Did you consider that case?

As you say, the cheap way to take all the sources is a pty. But can
N_PPS on a pty ever report a pulse? If pps_tty_dcd_change() is never
called there, wouldn't refusing N_PPS on a pty be enough, leaving the
real serial ports as they are today?

>  	info.owner = THIS_MODULE;
>  	info.dev = NULL;
>  	snprintf(info.name, PPS_MAX_NAME_LEN, "%s%d", drv->driver_name, index);
> --
> 2.43.0

Ciao,

Rodolfo

-- 
GNU/Linux Solutions                  e-mail: giometti@enneenne.com
Linux Device Driver                          giometti@linux.it
Embedded Systems                     phone:  +39 349 2432127
UNIX programming