[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Date: Thu, 6 Jun 2013 15:02:37 +0200
From: "Jason A. Donenfeld" <Jason@...c4.com>
To: oss-security <oss-security@...ts.openwall.com>
Subject: chroots & uid sharing
Hi folks,
Some people would be surprised to learn you can ptrace processes from
inside chroots that exist outside of chroots. So, if there are two
processes, one chrooted, and one unchrooted, both using the same UID,
you can ptrace your way out of the chroot pretty easily. Grsecurity
actually adds a little nob to the kernel to disallow this.
What I wonder is how many distros are shipping various daemons that
run under the nobody user, with certain ones chrooting and others not.
How should we handle this?
More generally, I'm wondering what the attitude should be toward this
kind of violation when it occurs within a particular daemon. For
example, OpenSMTPD forks a bunch of processes, and drops privs of some
and chroots others. But they violate the uid-per-chroot rule,
rendering the chroots useless. Should this be considered a security
flaw? Or just a silly design consideration?
This disgusting and offensive one-liner shows such flawed chroots:
krantz ~ # for i in /proc/[0-9]*; do echo $(readlink -f $i/root)
$(stat -c "%u %g" $i 2>/dev/null); done | sort | uniq | egrep "$(for i
in /proc/[0-9]*; do if [ "$(readlink -f $i/root)" != "/" ]; then stat
-c "%u %g" $i 2>/dev/null; fi; done | sort | uniq | tr '\n' '|' | head
-c -1)" | ( u=""; l=""; while read line; do nu="$(cut -d ' ' -f 2,3
<<<"$line")"; if [ "$nu" == "$u" ]; then if [ "$l" != "" ]; then echo
"$l"; fi; echo "$line"; else l="$line"; fi; u="$nu"; done )
/ 25 25
/var/empty 25 25
Thoughts?
Jason
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
