Openwall GNU/*/Linux - a small security-enhanced Linux distro for servers
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Mon, 30 Jul 2012 10:52:25 +0200
From: Ludwig Nussel <ludwig.nussel@...e.de>
To: oss-security@...ts.openwall.com
Subject: Re: libdbus hardening

Simon McVittie wrote:
> On 10/07/12 14:09, Sebastian Krahmer wrote:
>> We are going to add a libdbus hardening patch:
>>
>> https://bugzilla.novell.com/show_bug.cgi?id=697105
>>
>> This is because some suid binaries (Xorg and others) are linked against libdbus
> 
> The tl;dr: version if (e.g.) your Xorg binary still uses HAL and is also
> setuid, ensure that it cleans its environment using a whitelist before
> its first use of libdbus, libhal, any other non-trivial library, or exec().
> 
> In off-list discussion with the other D-Bus upstream maintainers,
> consensus was that binaries with greater privileges than their parent
> process (setuid or VFS capabilities) must not use non-trivial libraries
> [...]
> In particular, we do not support use of libdbus in setuid binaries that
> do not sanitize their environment before their first call into libdbus.

PAM modules of systemd and consolekit use libdbus though. PAM can't
scrub the environment before calling modules as those modules may want
to do something with the information gained from the original
environment (like e.g. pam_xauth).

cu
Ludwig

-- 
 (o_   Ludwig Nussel
 //\
 V_/_  http://www.suse.de/
SUSE LINUX Products GmbH, GF: Jeff Hawn, Jennifer Guild, Felix Imend├Ârffer, HRB 16746 (AG N├╝rnberg) 

Powered by blists - more mailing lists

Your e-mail address:

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.