Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Thu, 24 May 2012 12:40:10 -0600
From: Kurt Seifried <>
CC: David Black <>,
        Peter van Dijk <>,
        Bert Hubert <>
Subject: Re: CVE Request: powerdns does not clear supplementary

Hash: SHA1

CC'ing the PowerDNS guys.

On 05/24/2012 10:20 AM, David Black wrote:
> Powerdns does not drop/clear supplementary groups in its dropPrivs 
> routine where the intent is to drop privileges.
> The relevant code can be found in pdns/ / 
> pdns-recursor-3.3/ [0].
> Can a CVE id be assigned for this issue?
> [0] pdns/ / pdns-recursor-3.3/ //
> Drops the program's privileges. void Utility::dropPrivs( int uid,
> int gid ) { if(gid) { if(setgid(gid)<0) { 
> theL()<<Logger::Critical<<"Unable to set effective group id to 
> "<<gid<<": "<<stringerror()<<endl; exit(1); } else 
> theL()<<Logger::Info<<"Set effective group id to "<<gid<<endl;
> }
> if(uid) { if(setuid(uid)<0) { theL()<<Logger::Critical<<"Unable to
> set effective user id to "<<uid<<":  "<<stringerror()<<endl; 
> exit(1); } else theL()<<Logger::Info<<"Set effective user id to
> "<<uid<<endl; } }

So the dropping of groups and the dropping of supplementary groups has
come up a lot recently, here are my personal thoughts on the matter
(with thanks to Steve Grubb for explaining some of the trickier bits).
These are of course my personal opinions, any mistakes/errors are mine
entirely and so on.

Dropping of the primary user and group privileges is a well known
security feature in many programs (e.g. bind, dhcp, apache, etc.). The
idea being programs need root to bind to privileged ports/etc. But
once done don't need root access. I think clearly in this case if a
program is running as root, and claims to give up root privileges but
fails to, that is a security issue and worthy of a CVE. In the case
where a program does NOT drop privileges, and this feature has now
been added (and assuming it works), I think this qualifies as security
hardening, not a security fix and NOT worthy of a CVE.

Now it gets messy. What about the dropping of supplementary groups?

Supplemental groups enabled a user to be a member of more than one
group at a time (us old timers remember the joys of "newgrp"). Why
would anyone want this? You could for example create a group that has
permissions to access logging, terminals (e.g. modems, remember those?
=) and then add users to it as appropriate (and centralize
account/permissions management somewhat and all that good stuff).

So what happens when a program starts running as say root, and root
has supplemental groups (like "bin" or "daemon" and the program drops
its primary user/group but fails to drop supplementary groups, is that
a security issue, and is it worthy of a CVE identifier?

For most cases I'm going to say probably not (aka no). Having
supplementary groups is intentional and allows permissions to be more
fine grained, you can for example make root a member of "logging" so
that even when the app drops root privileges would still have the
supplementary group of "logging" and can do its logging or whatever.

So unless someone makes a compelling argument that these are security
issues I'm going to err on the side of "security hardening" instead of
"security fix" for dropping supplementary groups, but of course not
all issues are the same so if you have a specific issue and think it
deserves a CVE make a case on OSS-sec.

* Should these issues be fixed? yes. Dropping privileges where
possible is usually a good idea, until things break though and then
people start disabling things like SELinux or running everything as
root to "make it work" :P.

- -- 
Kurt Seifried Red Hat Security Response Team (SRT)
PGP: 0x5E267993 A90B F995 7350 148F 66BF 7554 160D 4553 5E26 7993

Version: GnuPG v1.4.12 (GNU/Linux)
Comment: Using GnuPG with Mozilla -


Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.