Date: Thu, 17 Mar 2011 14:18:11 -0400 From: Nelson Elhage <nelhage@...lice.com> To: oss-security@...ts.openwall.com Cc: Dan Rosenberg <dan.j.rosenberg@...il.com> Subject: Re: The risks of cleaning /tmp The tmpreaper package (at least in Debian) has a pretty good writeup of a lot of the security problems involved in cleaning /tmp, which I've copied at <http://nelhage.com/files/README.security>, since I can't find another good source online. It's probably worth reading that document to get perspective on some of the thought that's been put into this problem before. - Nelson On Thu, Mar 17, 2011 at 1:56 PM, Dan Rosenberg <dan.j.rosenberg@...il.com> wrote: > Hi all, > > A number of utilities (notably tmpwatch on Red Hat/Fedora) are > designed to regularly clean the contents of the /tmp directory. I > wanted to draw some attention to the fact that these applications, as > well as setting up cronjobs to perform the same task, introduce the > same risks as detailed in Tavis Ormandy's advisory for seunshare . > Namely, they make it such that the stickiness of /tmp can no longer be > relied on. > > Consider a setuid application that relies on the fact that users can't > delete its resources in /tmp because they're root owned. An attacker > can simply launch the application and send a SIGSTOP at the right > moment to cause it to sleep indefinitely, until tmpwatch (or similar) > removes its /tmp resources, allowing them to be replaced by the > attacker. As Tavis pointed out, doing this with ksu could allow > denial of service, but it may be possible to escalate privileges by > leveraging other applications. > > It seems like a difficult problem to solve - it's hardly feasible to > rewrite every suid app that relies on the stickiness of /tmp. > Hopefully we can generate some useful discussion here. > > Regards, > Dan > >  http://marc.info/?l=full-disclosure&m=129842239022495&w=2 >
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.